[KEV] CVE-2026-32202 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-32202 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-32202 is a protection mechanism failure vulnerability in the Microsoft Windows Shell component that enables an unauthenticated, network-based attacker to conduct spoofing attacks against affected Windows systems.

Technical Detail

The flaw resides in the Windows Shell and involves a failure in a protection mechanism that is intended to validate or enforce trust boundaries, allowing an attacker operating over a network to spoof content, identity, or system responses without requiring prior authentication. The precise internal mechanism has not been fully disclosed publicly, but the spoofing primitive could be leveraged to deceive users or downstream systems into trusting malicious input, potentially enabling follow-on attacks such as credential theft, session hijacking, or code execution depending on the application context. The network-accessible attack vector and lack of authentication requirement lower the barrier for exploitation significantly.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this CVE to the Known Exploited Vulnerabilities catalog on April 28, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and is being used in real-world attacks, not merely demonstrated in a controlled research setting. Organizations should treat this as an actively weaponized vulnerability requiring immediate action.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. No targeted sectors or campaigns have been formally associated with exploitation of this vulnerability in available intelligence. This assessment may change as incident data is collected and analyzed.

What To Do

Apply the relevant Microsoft security update immediately. Per CISA's Binding Operational Directive 22-01, federal civilian executive branch agencies are required to remediate this vulnerability by the deadline established upon KEV listing on April 28, 2026. All organizations should prioritize patching Windows systems exposed to network access, particularly those where the Windows Shell is reachable by untrusted users or external network segments. Until patching is complete, consider restricting network access to affected systems where operationally feasible and monitoring for anomalous spoofing-related activity in network and endpoint logs. Check Microsoft's Security Update Guide for the specific KB article and affected Windows versions applicable to your environment.