Windows Shell Flaw Becomes Zero Click Tool for Credential Theft
A newly discovered vulnerability, CVE-2026-32202, has been found to affect Windows systems due to an incomplete patch for a previously known exploit. This vulnerability allows for zero-click authentication coercion, enabling attackers to authenticate to a victim's server without any user interaction. The original exploit, CVE-2026-21510, was used by the APT28 threat actor to bypass security features such as Microsoft Defender SmartScreen and execute attacker-controlled code. The incomplete patch, which was intended to fix the original vulnerability, left behind a new zero-click vulnerability that can be exploited by attackers.
The exploitation chain for this vulnerability involves the use of a malicious LNK file, which contains a LinkTargetIDList that can be parsed by shell32.dll and presented in Windows Explorer. The IDList is a binary structure that contains object information, including a CLSID that represents the Control Panel Component Object Model (COM) object. When the malicious LNK file is rendered in Windows Explorer, it triggers a call chain that leads to the loading of a DLL from a remote server using a UNC path. The DLL is loaded as part of the Control Panel (CPL) objects without proper network zone validation, allowing attackers to execute malicious code. The patch for the original vulnerability introduced a new COM object called ControlPanelLinkSite, which acts as a bridge between the CPL launch path and ShellExecute's trust verification mechanism. However, this patch did not fully address the vulnerability, leaving behind a zero-click authentication coercion vulnerability.
The discovery of this new vulnerability highlights the importance of thorough patch testing and the need for continuous monitoring of systems for potential security threats. The fact that the incomplete patch created a new zero-day vulnerability demonstrates the complexity of vulnerability management and the potential for unintended consequences. To mitigate this vulnerability, users should ensure that their systems are up-to-date with the latest security patches and implement additional security measures such as network segmentation and monitoring. It is also essential to conduct regular security audits and penetration testing to identify potential vulnerabilities and weaknesses in systems. The exploitation of this vulnerability can have significant consequences, including the loss of confidentiality, integrity, and availability of sensitive data.
Attack Surface
Endpoint, Endpoint OS, File Storage, Infrastructure
Tactics
Initial Access, Execution, Privilege Escalation, Credential Access, Defense Evasion
Techniques
- T1190 – Exploit Public-Facing Application
- T1204 – User Execution
- T1559.001 – Inter-Process Communication: Component Object Model
- T1185 – Browser Bridge (via MSHTML)
- T1557.001 – Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
- T1218.002 – System Binary Proxy Execution: Control Panel
SuperPRO's Threat Countermeasures Procedures
- Apply the latest security patches to Windows systems immediately to all Windows endpoints
- Disable or restrict Outbound SMB traffic to the internet at the network firewall level
- Enforce the use of SMB Signing and SMB Encryption to prevent relay-style attacks
- Configure Windows to prevent the automatic sending of NTLM credentials to untrusted remote hosts
- Implement a robust Credential Guard policy to protect derived domain credentials
- Monitor network logs for unusual UNC path resolutions or unexpected outbound SMB connections to external IP addresses