EUVD-2026-22589
GHSA-x62h-w968-3v9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted network content
-
DeliveryUser interacts with shell
-
ExploitValidation mechanism fails
-
ExecutionSpoofed identity accepted
-
ImpactInformation disclosure or trust abuse
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Impact | This vulnerability presents a moderate real-world risk despite its low CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates an unauthenticated, low-complexity remote attack requiring user interaction with limited confidentiality impact but no integrity or availability impact. The low EPSS probability and absent KEV status suggest minimal active exploitation likelihood. However, the spoofing nature of the vulnerability and universal presence across Windows SKUs (desktop and server) means it could affect credential harvesting, phishing, or trust-based attacks. The availability of vendor patches and user interaction requirement mitigate urgency, making this a standard-priority remediation rather than a critical incident. Organizations should prioritize based on exposure to untrusted networks rather than threat severity alone. |
| Exploit ScenarioDerived | An attacker crafts malicious content (such as specially formatted files, network resources, or shortcuts) that exploits the shell's failed validation mechanisms. When a user interacts with this content through Windows Explorer or related shell interfaces-such as browsing a network share, opening a downloaded file, or previewing content-the shell fails to properly validate the authenticity or source of the item. The attacker successfully spoofs the identity or source of the content, potentially deceiving the user into trusting malicious material or revealing information based on the false representation. No public exploit code has been identified; exploitation relies on social engineering combined with the underlying shell vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a network without authentication, requiring only user interaction. This low-severity vulnerability affects multiple Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. While not actively exploited in the wild, vendor patches are available across all affected versions, and the low CVSS score (4.3) reflects limited confidentiality impact and no availability impact despite the network-accessible attack vector.
RemediationAI
Vendor-released patch available per Microsoft Security Response Center. Organizations should apply Windows updates containing the cumulative security patches for their respective OS versions, using the build numbers specified in the EUVD data as minimum patched versions (for example, Windows 10 Version 22H2 requires 10.0.19045.7184 or later). Updates can be deployed via Windows Update, WSUS, or manual patch installation from the Microsoft Update Catalog. For organizations unable to patch immediately, restrict network access to untrusted sources and educate users to avoid interacting with suspicious shell content or file operations from unknown origins. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 for specific patch delivery timelines and https://vuldb.com/vuln/357515 for additional mitigation context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 36 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Windows Shell's protection mechanisms, specifically a failure in how the shell validates or enforces security boundaries (CWE-693: Protection Mechanism Failure). Windows Shell is the core user interface component responsible for file browsing, application launching, and user-system interactions. The spoofing capability suggests an attacker can impersonate or misrepresent content through the shell interface. The network attack vector combined with user interaction requirement indicates the attack likely involves crafted network content or specially formed inputs that deceive the shell's trust mechanisms. The root cause classification under CWE-693 indicates the security control itself is flawed rather than bypassed through a traditional code execution pathway.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
Articles & Coverage 1
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit