Microsoft Confirms Russian Hackers Exploited Zero-Click Windows Flaw From Botched Patch

Botched Patch Reopens Critical Windows Vulnerability

Microsoft has confirmed that a Windows Shell vulnerability, tracked as CVE-2026-32202, is being actively exploited in the wild after emerging from a flawed fix for an earlier flaw, CVE-2026-21510. Originally addressed in February 2026, the incomplete patch left a critical gap that allowed attackers to harvest user credentials without requiring any interaction from victims. Microsoft revised its advisory on Monday to acknowledge ongoing exploitation, and a proper fix was rolled out as part of the April 2026 Patch Tuesday update.

From One-Click to Zero-Click Attack

Security researcher Maor Dahan from Akamai uncovered that whilst the February patch successfully blocked the remote code execution path by enforcing SmartScreen verification, victim machines were still authenticating to attacker-controlled servers. The vulnerability lies in how Windows Explorer handles malicious shortcut, or LNK, files. When a folder containing a crafted LNK file is rendered, Windows Explorer requests an icon from a UNC path, triggering a server message block connection to the attacker's server. This happens entirely without user interaction. The connection initiates an automatic NTLM authentication handshake, sending the victim's Net-NTLMv2 hash to the attacker, which can be used for NTLM relay attacks and offline password cracking.

APT28 Campaign Against Ukraine and Europe

According to Akamai, the vulnerabilities were likely exploited by the Russian nation-state hacking group APT28, also known as Fancy Bear and Forest Blizzard, beginning in December 2025. The campaign targeted Ukraine and European Union countries, using weaponised LNK files that chained CVE-2026-21513 and CVE-2026-21510 to bypass Windows security features and achieve remote code execution. APT28 leveraged the Windows shell namespace parsing mechanism to load a dynamic link library from a remote server using a UNC path, with the DLL loaded as part of Control Panel objects without proper network zone validation.

Broad Impact and Urgent Patching

CVE-2026-32202 affects a wide range of Windows systems, including Windows 10, Windows 11, and multiple Windows Server versions. The U.S. Cybersecurity and Infrastructure Security Agency had already added the original CVE-2026-21510 to its Known Exploited Vulnerabilities catalogue in February with a remediation deadline of 3rd March 2026. Organisations that have not yet applied April's updates remain exposed to zero-click credential theft attacks, making prompt patching essential.