All vulnerabilities
CVE-2026-32202

Microsoft Windows Protection Mechanism Failure Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationExploited in the wildAdded to KEV 28 Apr 2026CISA KEV
Exploit odds (EPSS)4.90%Chance of exploitation activity in the next 30 days, higher than 92% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.14393.9339Also 10.0.17763.9020, 10.0.19044.7548 and 9 moreCVE List
Federal deadline12 May 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 10.0.14393.9339Windows 10 Version 1607CVE List
  • 10.0.17763.9020Windows 10 Version 1809CVE List
  • 10.0.19044.7548Windows 10 Version 21H2CVE List
  • 10.0.19045.7548Windows 10 Version 22H2CVE List
  • 10.0.22631.7376Windows 11 version 23H2CVE List
  • 10.0.22631.7376Windows 11 Version 23H2CVE List
Show all 20 fixed versions
  • 10.0.26100.8875Windows 11 Version 24H2CVE List
  • 10.0.26200.8875Windows 11 Version 25H2CVE List
  • 10.0.28000.2525Windows 11 version 26H1CVE List
  • 6.2.9200.26226Windows Server 2012CVE List
  • 6.2.9200.26226Windows Server 2012 (Server Core installation)CVE List
  • 6.3.9600.23291Windows Server 2012 R2CVE List
  • 6.3.9600.23291Windows Server 2012 R2 (Server Core installation)CVE List
  • 10.0.14393.9339Windows Server 2016CVE List
  • 10.0.14393.9339Windows Server 2016 (Server Core installation)CVE List
  • 10.0.17763.9020Windows Server 2019CVE List
  • 10.0.17763.9020Windows Server 2019 (Server Core installation)CVE List
  • 10.0.20348.5386Windows Server 2022CVE List
  • 10.0.26100.33158Windows Server 2025CVE List
  • 10.0.26100.33158Windows Server 2025 (Server Core installation)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 14 Apr 2026, 16:57 UTCPublishedCVE List
  2. 28 Apr 2026Added to CISA KEVCISA KEV
  3. 29 May 2026Exploit code publicExploit-DB

Public exploit code and templates 1

  • Remote exploitMicrosoft - NTLMv2 Hash Capture 29 May 2026Exploit-DB

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.

Text from CVE List

Affected versions 20

  • Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.9339CVE List
  • Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.9020CVE List
  • Windows 10 Version 21H2affected: 10.0.19044.0 before 10.0.19044.7548CVE List
  • Windows 10 Version 22H2affected: 10.0.19045.0 before 10.0.19045.7548CVE List
  • Windows 11 version 23H2affected: 10.0.22631.0 before 10.0.22631.7376CVE List
  • Windows 11 Version 23H2affected: 10.0.22631.0 before 10.0.22631.7376CVE List
  • Windows 11 Version 24H2affected: 10.0.26100.0 before 10.0.26100.8875CVE List
  • Windows 11 Version 25H2affected: 10.0.26200.0 before 10.0.26200.8875CVE List
  • Windows 11 version 26H1affected: 10.0.28000.0 before 10.0.28000.2525CVE List
  • Windows Server 2012affected: 6.2.9200.0 before 6.2.9200.26226CVE List
  • Windows Server 2012 (Server Core installation)affected: 6.2.9200.0 before 6.2.9200.26226CVE List
  • Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.23291CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.23291CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.9339CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.9339CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.9020CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.9020CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.5386CVE List
  • Windows Server 2025affected: 10.0.26100.0 before 10.0.26100.33158CVE List
  • Windows Server 2025 (Server Core installation)affected: 10.0.26100.0 before 10.0.26100.33158CVE List

References 6