A patch does not always close the door. Sometimes, an incomplete fix leaves behind a new path for attackers.
Akamai says that is what happened with CVE-2026-32202. The flaw emerged from Microsoft’s incomplete patch for CVE-2026-21510, a past zero-day vulnerability the researchers tied to an APT28 (also known as Fancy Bear) exploit chain.
Akamai researchers say the issue stems from how Windows Explorer parses malicious .LNK shortcut files and Control Panel objects. In the wild, the flaw was weaponized against Ukrainian government targets to seed malware payloads.
Ukraine’s national computer emergency response team, CERT-UA, said the earlier exploit chain targeted organizations in Ukraine and several EU countries in December 2025.
[Related: NIST Scales Back CVE Details to Manage Report Surge]
Normally, Windows security tools, such as Microsoft Defender SmartScreen, will scrum a document for dangerous files before execution and issue an alert when unsafe actions are initiated. In this case, Akamai said the exploit chain combined the Windows Shell / LNK file handling vulnerability (CVE-2026-21513) with CVE-2026-21510 inside a single malicious LNK file. The CVE-2026-21510 flaw (a Windows Shell security feature bypass vulnerability) bypassed SmartScreen protections and allowed attacker-controlled code from a remote server to execute.
“APT28 leverages the Windows shell namespace parsing mechanism to load a dynamic link library (DLL) from a remote server using a UNC path,” Akamai said. “The DLL is loaded as part of Control Panel objects without proper network zone validation.”
Akamai said it detected the APT28 exploit in January 2026, and Microsoft patched CVE-2026-21510 and CVE-2026-21513 in its February Patch Tuesday release.
But the fix addressed only part of the attack chain.
The February patch only fixed the last link in the attack chain. It utilized the Windows SmartScreen component to prevent embedded code in documents from dialing out to servers without authentication. It routed the Windows Control Panel launch path for files through SmartScreen trust verification before allowing untrusted CPL files to run.
A .CPL file is essentially a Dynamic Link Library (DLL) that Windows uses to provide Control Panel applet functions – such as Mouse settings, Network settings, or Programs and Features.
On the surface, that should have stopped the attack.
It did not.
The problem, however, was located further up in the attack chain. While Microsoft mitigated the remote code execution and SmartScreen bypass stages, Windows was still manipulated to reach out to the attacker-controlled servers before trust verification occurred. This is a design gap that exposed authentication data even without code execution, researchers said.
That gap led Akamai researchers to identify CVE-2026-32202. The new flaw triggers when Windows Explorer extracts an icon from a malicious LNK file. That routine action causes the system to initiate an SMB connection to an attacker-controlled server and send a Net-NTLMv2 hash – otherwise called an adversary-in-the-middle (AiTM) technique.
NTLM (NT LAN Manager) is an older Windows authentication protocol that lets a user or system prove its identity to another system—usually over a network—without sending the actual password.
In this specific case, when Windows attempts to load the malicious shortcut’s icon from a remote server, it automatically authenticates using NTLM. Using this security loophole, attackers could abuse the Net-NTLMv2 hashes to relay or crack credentials, enabling lateral movement, privilege escalation, or access to additional systems without ever executing malware on the victim machine.
“The most dangerous path requires no user interaction beyond navigating to a folder,” Akamai said. “When Windows Explorer renders the contents of a folder containing the malicious LNK, it asks shell32 to extract an icon for the CPL IDList item.”
This type of “zero-click” behavior – where normal system activity triggers network authentication – fits a broader class of attacks known as authentication coercion, which has become a recurring technique in credential theft campaigns.
The finding highlights a persistent problem in modern vulnerability management: patches that stop visible exploit behavior can still leave quieter, earlier stages of an attack chain intact.
In this case, Microsoft blocked the payload. It did not stop Windows from reaching out to attacker infrastructure in the first place.
For defenders, the lesson is less about malware execution and more about identity exposure. The attack turns a routine user action—opening a folder—into a credential leak.
Users and administrators are advised to apply Microsoft’s update for CVE-2026-32202 and monitor for suspicious SMB or NTLM authentication attempts tied to malicious LNK files. Restricting outbound SMB traffic and reducing reliance on NTLM authentication can further limit exposure.
Shaun Nichols is an IT news journalist. He has spent nearly 20 years covering the industry with a specialty in the cybersecurity
Adapted
