EUVD-2026-22589
GHSA-x62h-w968-3v9v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
8DescriptionCVE.org
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
Articles & Coverage 1
AnalysisAI
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a network without authentication, requiring only user interaction. This low-severity vulnerability affects multiple Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. While not actively exploited in the wild, vendor patches are available across all affected versions, and the low CVSS score (4.3) reflects limited confidentiality impact and no availability impact despite the network-accessible attack vector.
Technical ContextAI
The vulnerability resides in Windows Shell's protection mechanisms, specifically a failure in how the shell validates or enforces security boundaries (CWE-693: Protection Mechanism Failure). Windows Shell is the core user interface component responsible for file browsing, application launching, and user-system interactions. The spoofing capability suggests an attacker can impersonate or misrepresent content through the shell interface. The network attack vector combined with user interaction requirement indicates the attack likely involves crafted network content or specially formed inputs that deceive the shell's trust mechanisms. The root cause classification under CWE-693 indicates the security control itself is flawed rather than bypassed through a traditional code execution pathway.
RemediationAI
Vendor-released patch available per Microsoft Security Response Center. Organizations should apply Windows updates containing the cumulative security patches for their respective OS versions, using the build numbers specified in the EUVD data as minimum patched versions (for example, Windows 10 Version 22H2 requires 10.0.19045.7184 or later). Updates can be deployed via Windows Update, WSUS, or manual patch installation from the Microsoft Update Catalog. For organizations unable to patch immediately, restrict network access to untrusted sources and educate users to avoid interacting with suspicious shell content or file operations from unknown origins. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 for specific patch delivery timelines and https://vuldb.com/vuln/357515 for additional mitigation context.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today