Loading story…
Researchers reported that CVE-2025-59214 is a zero-click Windows NTLM credential-leakage flaw that bypasses prior mitigations for CVE-2025-24054 and CVE-2025-50154. A crafted shortcut can cause Windows Explorer to automatically authenticate to an attacker-controlled UNC/SMB endpoint, disclosing an NTLMv2-SSP hash without requiring victim interaction; the issue was reportedly reproduced on a fully updated Windows Server 2022 system with KB5063880 installed.
The leak stems from inconsistent validation of shortcut fields: Explorer checks icon paths but can process a UNC target path through an alternate existence-check path that initiates NTLM authentication. Attackers could crack captured hashes offline or relay them to other services, creating paths to unauthorized access, privilege escalation, lateral movement, or remote code execution depending on the exposed account and environment. Earlier reporting documented exploitation of CVE-2025-24054 in the wild, underscoring the operational risk of NTLM coercion through malicious Windows shortcut content.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft issued a March 2025 patch intended to prevent NTLMv2-SSP hash disclosure caused by shortcut-file creation in explorer.exe.
Researchers reproduced CVE-2025-59214 on a fully updated Windows Server 2022 system with KB5063880. Uploading a crafted LNK file to an SMB share open in a Domain Admin session immediately caused the session's NTLMv2-SSP hash to be received by a researcher-controlled Responder listener.
Cymulate Research Labs disclosed a further bypass to Microsoft, which assigned CVE-2025-59214. The flaw can cause Explorer shortcut handling to authenticate automatically to an attacker-controlled UNC/SMB endpoint and expose an NTLMv2-SSP hash without user interaction.
A bypass of the prior mitigations was identified using an LNK file whose Target value was a UNC path while its Icon value referenced the default shell32.dll file.
Check Point Research reported that CVE-2025-24054, an NTLM-related Windows vulnerability, was being exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cymulate.com
Open sourceresearch.checkpoint.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed that **CVE-2026-32202**, a patched Windows Shell spoofing flaw, has been actively exploited in the wild after initially publishing incorrect exploitability information. The vulnerability is a **zero-click authentication coercion issue** tied to an incomplete fix for **CVE-2026-21510** and can be triggered when Windows Explorer processes a malicious `.LNK` file. Researchers said the shortcut’s crafted `LinkTargetIDList` can force the system to resolve an attacker-controlled UNC path, causing an outbound SMB connection and NTLM authentication attempt before SmartScreen trust checks occur. Akamai and CERT-UA linked the activity to **APT28**, which used weaponized LNK files in campaigns against Ukraine and several EU countries beginning in December 2025, chaining **CVE-2026-21513** with **CVE-2026-21510** for code execution and then abusing the residual flaw to capture **Net-NTLMv2** hashes for relay attacks or offline cracking. Microsoft addressed **CVE-2026-32202** in its April 2026 Patch Tuesday release, and defenders were urged to patch quickly, monitor outbound SMB traffic, and reduce or harden NTLM usage to limit follow-on credential abuse.
Jun 29, 2026
Researchers reported an unpatched NTLM credential coercion flaw in the Windows Explorer `search:` URI handler that can force a victim system to authenticate to an attacker-controlled SMB server and expose a Net-NTLMv2 hash after a single click on a crafted link. Testing showed the behavior worked on Windows 11 25H2 Pro with default Microsoft Defender settings, required no malware or elevated privileges, and could be triggered from both a command line and an Edge hyperlink that invoked the handler. The issue was described as materially equivalent to Microsoft-patched `CVE-2026-33829` in the Windows Snipping Tool because both involve unsafe URI parameter handling that leads to outbound UNC access and NTLM authentication. Huntress said Microsoft rated the `search:` issue as **Moderate** and declined to issue a fix, while analysis indicated `search:` and `search-ms:` share the same `DelegateExecute` CLSID and COM activation path in `ExplorerFrame.dll`, suggesting any durable remediation would need to occur in `SearchExecute` or related Explorer code rather than only at the URI-scheme layer. Recommended mitigations include blocking outbound SMB, enforcing SMB signing, restricting or disabling NTLM, and monitoring for `search:` and `search-ms:` URIs in email and proxy logs.
Jun 29, 2026
Microsoft has patched **CVE-2026-33829**, a spoofing vulnerability in the Windows Snipping Tool that can trigger an authenticated SMB connection to an attacker-controlled server and expose a victim’s **NTLMv2 password hash**. The flaw stems from improper validation of deep links using the `ms-screensketch` URI scheme, allowing attackers to coerce the application into initiating network authentication and leaking credentials over the network. Researchers at **Blackarrow (Tarlogic)** reported the issue, which Microsoft rated **moderate severity** with a **CVSS 3.1 score of 4.3** and said was **not known to be exploited in the wild**. Exploitation requires user interaction, such as clicking a malicious link in a phishing email or on a compromised website, but the attack complexity is considered low. Affected systems include multiple **Windows 10, Windows 11, and Windows Server** releases, and recommended defenses include applying Microsoft’s update, blocking outbound SMB traffic on port `445`, and warning users against suspicious links and application launch prompts.
Jun 29, 2026