Windows Shell SmartScreen and Security Prompt Bypass via Malicious LNK/Link
CVE-2026-21510 is a Windows Shell protection mechanism failure / security feature bypass vulnerability in Microsoft Windows. The issue allows attacker-controlled content delivered via a malicious link or Windows shortcut (LNK) file to bypass Windows Defender SmartScreen and Windows Shell security prompts. Multiple sources in the provided content describe exploitation through specially crafted LNK content and Windows Shell namespace parsing, where attacker-controlled remote content can be invoked without the normal warning and consent flow. In observed campaigns, the flaw was used in phishing-driven attack chains and could be combined with other vulnerabilities such as CVE-2026-21513 or CVE-2026-21509. The vulnerability was actively exploited in the wild as a zero-day and was added to CISA's KEV catalog.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a small standalone Python exploit generator consisting primarily of one large script, lnkstomperpoint.py, plus a README and .gitignore. The script is not a scanner or detector; it is an offensive utility that programmatically builds crafted Windows .lnk files purportedly targeting CVE-2026-21510, a Windows Shell Link remote code execution issue. Based on the visible code and README, its core purpose is to generate malicious shortcut files with attacker-controlled target executable, arguments, working directory, and multiple Shell Link ExtraData structures. Main capabilities described and partially evidenced in code include: LNK stomping variants, manipulation of Shell Link flags and CLSIDs, KnownFolder and PropertyStore data block generation, environment variable blocks, argument obfuscation, optional embedded payload handling, AES encryption support via pycryptodome, anti-forensics options, randomized metadata/CLSID/KnownFolder values, and generation of multiple variants for signature evasion. The script imports AES, padding, random byte generation, struct handling, and logging, indicating real implementation effort rather than a placeholder. Logging is configured to write to cve_2026_21510_ultimate_absolute.log. The visible tail of the script shows a CLI workflow that instantiates an exploit object with many offensive options and writes a generated .lnk file. The README documents extensive CLI options such as --target, --args, --output, --working-dir, --embed-payload, --encrypt-payload, --anti-forensics, --randomize-clsid, --randomize-known-folder, --obfuscate-arguments, and --generate-variants. Example usage demonstrates launching cmd.exe with /c calc.exe, embedding a payload file, and using powershell.exe with a Net.WebClient DownloadString call to retrieve a remote script from http://evil.com/shellcode.ps1. That example introduces a clear web/network-capable second stage, although the generator itself mainly produces a file-based initial vector. Overall, this repository is a standalone operational exploit builder for malicious Windows shortcut generation. Its structure is simple, but the single Python file appears feature-rich and focused on producing obfuscated, evasive .lnk payloads for execution on Windows targets.
This repository is a small exploit-builder project with 4 files: a license, a README, and two Python scripts. It is not a scanner or detector; it generates malicious artifacts for a document-based exploit chain targeting CVE-2026-21514 and CVE-2026-21510. Structure and purpose: - README.md documents the intended exploit chain and experimentation notes. It describes a Protected View/SBX bypass component and an RCE component, including CLSID changes, XML/object changes, and possible DLL-to-CPL substitution. - gen_rtf.py builds exploit.rtf by inserting a UTF-16-style null-padded UNC/WebDAV path into a large hardcoded RTF/OLE blob. The embedded path is \\127.0.0.1@80/final.lnk, indicating the document is meant to cause retrieval of a remote LNK over port 80 via WebDAV-like UNC syntax. - make_lnk.py builds final.lnk from hardcoded hex templates plus a null-padded remote payload path. The referenced payload path is \\127.0.0.1\cc.dll. The script comments explicitly suggest generating the DLL with msfvenom using windows/meterpreter/reverse_tcp. Main exploit capabilities: - Generates a malicious RTF lure document. - Embeds a remote UNC/WebDAV path to a malicious LNK file. - Generates a malicious LNK that references a remote DLL payload over SMB/UNC. - Includes embedded HTML/JavaScript/ActiveX logic inside the LNK data, apparently to trigger file/URL handling and object loading behavior. - Supports straightforward operator customization by changing the hardcoded remote paths and replacing the DLL payload. Operationally, this is an exploit builder rather than a full delivery framework. The payload is basic and hardcoded, so OPERATIONAL is the best fit rather than WEAPONIZED. The code is clearly intended to achieve code execution on a vulnerable Windows/Office target by chaining remote file retrieval and DLL loading.
Repository contains a single Python proof-of-concept script and a detailed README. The main file, CVE-2026-32202.py, is a research-oriented generator for crafted Windows .lnk files that reproduce the LinkTargetIDList structure associated with CVE-2026-21510 / CVE-2026-32202. The script reconstructs three shell items: (1) a Control Panel root CLSID item, (2) an 'All Control Panel Items' category item, and (3) a Unicode _IDCONTROLW structure containing a user-supplied module path, typically a UNC path to a remote .cpl file. It exposes CLI options for the embedded UNC/local path, output filename, applet ID, display name, infotip, and optional hex dump suppression. The exploit capability is file generation rather than direct network communication; however, the generated LNK is intended to cause Windows Explorer/shell32 to access the embedded UNC path during rendering, which can coerce outbound SMB authentication or connection to an attacker-controlled share. The README provides reverse-engineering context, structure layouts, call-chain analysis, and explains that the vulnerable behavior occurs before later trust verification stages. Overall, this is a focused PoC/research tool for crafting malicious shortcut files to reproduce Windows shell path-resolution behavior, not a full weaponized framework or post-exploitation implant.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
109 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unknown
A Windows shell protection mechanism failure used to bypass Windows Shell security controls as part of an exploit chain following initial code execution.
A Windows zero-day that allowed execution of a malicious LNK file without triggering a Microsoft Defender SmartScreen warning prompt. It was exploited by APT28 and later incompletely patched, leading to CVE-2026-32202.
A high-severity Windows SmartScreen and Shell prompt bypass vulnerability whose incomplete patch led to a related zero-click authentication coercion issue. It was exploited by APT28 using trojanized LNK files.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.