CVE-2026-32202 in microsoft windows 10 1607
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
Affected software: microsoft windows 10 1607, microsoft windows 10 1809, microsoft windows 10 21h2, microsoft windows 10 22h2, microsoft windows 11 23h2, microsoft windows 11 24h2, microsoft windows 11 25h2, microsoft windows 11 26h1, microsoft windows server 2012, microsoft windows server 2016
Scores
- CVSS: 4.3 (medium)
- EPSS: 71.32% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-04-28
- Published: 2026-04-14
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install the April 2026 Windows security update (Windows Shell spoofing, CVE-2026-32202)
Patch or upgrade. Microsoft fixed the Windows Shell protection mechanism failure in the security updates released on 14 April 2026. Installing that cumulative update (or any later one) on every Windows client and server removes the spoofing risk.
Applies to: All supported Windows 10, Windows 11 and Windows Server versions (2012 through 2025) without the 14 April 2026 security update or a later cumulative update.
- Open the Microsoft Security Update Guide entry for CVE-2026-32202 (link below) and note the KB number of the security update for each Windows version you run.
- In WSUS, Configuration Manager, Intune (Windows Update rings) or your patch tool, approve the April 2026 cumulative security update (released 14 April 2026) or any later cumulative update for Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2012, 2016, 2019, 2022, 2022 23H2 and 2025.
- Deploy to workstations first: they open files and links from mail and the web, which is where shell spoofing is used. Then deploy to servers, including terminal servers and Citrix/RDS hosts.
- Restart each host to finish the installation.
- For Windows Server 2012 and 2012 R2, make sure the host is enrolled in Extended Security Updates (ESU); without ESU it does not receive this fix and should be retired or isolated.
- Check compliance in your patch tool, or run Get-HotFix on a host to confirm the KB from step 1 (or a later cumulative update) is installed.
- Until patched, remind users not to open unexpected files, shortcuts or links from mail, chat or downloads, as the attack needs user interaction.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.