Skip to content
OpenAdvisories
High 1 exploited CVE MSRC-CVE-2026-32202 1 CVE

Windows Shell Spoofing Vulnerability

Published Apr 14, 2026 · Updated Aug 21, 2026 · Revision 4

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Exploited according to Microsoft — Exploitation Detected. Customer action: Required.

Details

According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L),but lead to no loss of availability (A:N) and integrity (I:N)? What does that mean for this vulnerability?
An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality) but not all resources within the impacted component may be divulged to the attacker. The attacker cannot make changes to disclosed information (Integrity) or limit access to the resource (Availability).

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker would have to send the victim a malicious file that the victim would have to execute.

Security updates
10.0.17763.9020 — https://support.microsoft.com/help/5099538
10.0.20348.5386 — https://support.microsoft.com/help/5099540
10.0.19044.7548 — https://support.microsoft.com/help/5099539
10.0.26100.33158 — https://support.microsoft.com/help/5099536
10.0.26200.8875 — https://support.microsoft.com/help/5101650
10.0.22631.7376 — https://support.microsoft.com/help/5099414
10.0.14393.9339 — https://support.microsoft.com/help/5099535
6.2.9200.26226 — https://support.microsoft.com/help/5099445
6.3.9600.23291 — https://support.microsoft.com/help/5099444
10.0.28000.2525 — https://support.microsoft.com/help/5101649

Vulnerabilities 1

Revision history

  1. #4

    Updated an acknowledgement. This is an informational change only.

  2. #3

    This CVE has been re-released to comprehensively address the vulnerability identified by CVE-2026-32202. Microsoft recommends installing the July 2026 updates for your Windows operating systems.

  3. #2

    Corrected the Exploitability Index, Exploited flag and CVSS vector which was incorrect at the time of publication on 4/14/2026. This is an informational change only.

  4. #1

    Information published.

References