Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-32202 Published 2026-04-14 Updated 2 months ago Vendor/s Microsoft Product/s Windows Version/s \* > 10.0.14393.9060 KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 4.3 / 10 Medium Severity Details Base score 4.3 Medium Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged Confidentiality Low Integrity None Availability None Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description CVE-2026-32202 is a medium-severity spoofing vulnerability in Windows Shell actively exploited in the wild, affecting multiple Windows and Server versions. ## Why this matters CVE-2026-32202 represents a critical risk despite its CVSS score of 4.3 because it is listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. This protection mechanism failure in the Windows Shell allows attackers to perform network-based spoofing, tricking users into performing actions they believe are legitimate. Because it affects nearly all modern versions of Windows, including Windows 11 and Windows Server 2025, the potential attack surface is massive. Security teams should prioritize this update as active exploitation bypasses standard security assumptions, making it a high-priority target for threat actors seeking an initial foothold. ## CPE Microsoft | Product | Version Start | Version End (excl.) | Status | | --------------------------- | ------------- | ------------------- | ---------- | | windows\_10\_1607 | \* | 10.0.14393.9060 | vulnerable | | windows\_10\_1607 | \* | 10.0.14393.9060 | vulnerable | | windows\_10\_1809 | \* | 10.0.17763.8644 | vulnerable | | windows\_10\_1809 | \* | 10.0.17763.8644 | vulnerable | | windows\_10\_21h2 | \* | 10.0.19044.7184 | vulnerable | | windows\_10\_21h2 | \* | 10.0.19044.7184 | vulnerable | | windows\_10\_21h2 | \* | 10.0.19044.7184 | vulnerable | | windows\_10\_22h2 | \* | 10.0.19045.7184 | vulnerable | | windows\_10\_22h2 | \* | 10.0.19045.7184 | vulnerable | | windows\_10\_22h2 | \* | 10.0.19045.7184 | vulnerable | | windows\_11\_23h2 | \* | 10.0.22631.6936 | vulnerable | | windows\_11\_23h2 | \* | 10.0.22631.6936 | vulnerable | | windows\_11\_24h2 | \* | 10.0.26100.8246 | vulnerable | | windows\_11\_24h2 | \* | 10.0.26100.8246 | vulnerable | | windows\_11\_25h2 | \* | 10.0.26200.8246 | vulnerable | | windows\_11\_25h2 | \* | 10.0.26200.8246 | vulnerable | | windows\_11\_26h1 | \* | 10.0.28000.1836 | vulnerable | | windows\_11\_26h1 | \* | 10.0.28000.1836 | vulnerable | | windows\_server\_2012 | - | - | vulnerable | | windows\_server\_2012 | r2 | r2 | vulnerable | | windows\_server\_2016 | \* | 10.0.14393.9060 | vulnerable | | windows\_server\_2019 | \* | 10.0.17763.8644 | vulnerable | | windows\_server\_2022 | \* | 10.0.20348.5020 | vulnerable | | windows\_server\_2022\_23h2 | \* | 10.0.25398.2274 | vulnerable | | windows\_server\_2025 | \* | 10.0.26100.32690 | vulnerable | ## Related weakness (CWE) CWE-693 ## Remediation plan 1 ### Apply official patches Download and install the latest security updates from the Microsoft Security Update Guide. Microsoft has released specific KB articles for all supported versions of Windows and Windows Server to address this shell protection failure. 2 ### Update affected systems Verify that systems are running versions higher than the vulnerable builds, such as Windows 10 22H2 (10.0.19045.7184), Windows 11 24H2 (10.0.26100.8246), or Windows Server 2025 (10.0.26100.32690). 3 ### Restrict access Minimize the risk of network-based spoofing by implementing robust web and email filtering. Block untrusted file types and suspicious URLs that could be used to deliver the malicious payloads required to trigger the Windows Shell vulnerability. 4 ### Monitor for exploitation Enable advanced auditing for Windows Shell processes and monitor for unusual process execution patterns. Use EDR tools to detect anomalous behavior originating from explorer.exe or shell32.dll that correlates with network-based user interaction. ## Detection Guidance Detecting CVE-2026-32202 requires monitoring for anomalous Windows Shell activity. Security teams should look for unauthorized process calls following user interaction with external links or files. Monitor Event Logs for protection mechanism failures (CWE-693) and use EDR signatures to identify spoofed shell elements. Network-level detection should focus on identifying traffic patterns associated with known spoofing techniques targeting Windows Shell components across the network. ## References [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 Vendor Advisory ](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202)[https://www.vicarius.io/vsociety/posts/cve-2026-32202-detection-script-spoofing-vulnerability-in-windows-shell Third Party Advisory ](https://www.vicarius.io/vsociety/posts/cve-2026-32202-detection-script-spoofing-vulnerability-in-windows-shell)[https://www.vicarius.io/vsociety/posts/cve-2026-32202-mitigation-script-spoofing-vulnerability-in-windows-shell Mitigation Third Party Advisory ](https://www.vicarius.io/vsociety/posts/cve-2026-32202-mitigation-script-spoofing-vulnerability-in-windows-shell)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-32202 Third Party Advisory US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-32202) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)