"Microsoft fixed the initial RCE (CVE-2026-21510), an authentication coercion flaw (CVE-2026-32202) remained. This gap between path resolution and trust verification left a zero-click credential theft vector via auto-parsed LNK files," Akamai said in a Thursday report.
CISA orders FCEB agencies to patch by May 12
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-32202 to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday and ordered Federal Civilian Executive Branch (FCEB) agencies to patch Windows endpoints and servers within two weeks, by May 12, as mandated by Binding Operational Directive (BOD) 22-01. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the cybersecurity agency warned.
CISA instructed agencies to "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable." Although the directive applies only to U.S. federal agencies, CISA urged all security teams to prioritize deploying patches for CVE-2026-32202 and securing their networks as soon as possible.
Akamai, CERT‑UA, and APT28 in the exploit chain
Cybersecurity firm Akamai reported the authentication coercion flaw now tracked as CVE-2026-32202 after finding what it described as a zero-click vulnerability left behind when Microsoft incompletely patched a February remote code execution (RCE) flaw, CVE-2026-21510. Separately, CERT‑UA revealed that the Russian APT28 (aka UAC‑0001 and Fancy Bear) exploited CVE-2026-21510 in attacks against Ukraine and EU countries in December 2025 as part of an exploit chain that also targeted a LNK file flaw, CVE-2026-21513.
The reporting connects three named CVEs into a multi-stage attack in which initial RCE techniques and LNK file parsing were leveraged; Akamai characterized the remaining issue as an authentication coercion vulnerability that produced a zero-click credential theft vector through auto-parsed LNK files.
The technical gap: CVE-2026-21510, CVE-2026-21513, and CVE-2026-32202
According to Akamai, Microsoft patched the initial remote code execution bug (CVE-2026-21510) in February, but that patch did not close a related authentication coercion issue now cataloged as CVE-2026-32202. Akamai's description places the residual flaw in the interaction between path resolution and trust verification, which allowed credential theft without user interaction via auto-parsed LNK files.
Microsoft's public guidance, as reported, notes that remote attackers who successfully exploit the vulnerability in low-complexity attacks by sending "the victim a malicious file that the victim would have to execute," could "view some sensitive information" on unpatched systems. The source material also records that Microsoft flagged the CVE-2026-3220 flaw as exploited in attacks on Sunday after BleepingComputer reached out asking why an advisory released during the April 2026 Patch Tuesday had an exploitability assessment of 'Exploitation Detected' while the vulnerability was flagged as not exploited.
What this means for security teams, FCEB agencies, and adversaries
- Security teams: CISA has urged teams everywhere to prioritize remediation for CVE-2026-32202 and to apply vendor mitigations or discontinue affected products if mitigations are unavailable.
- Federal Civilian Executive Branch agencies: Under BOD 22-01 these agencies must patch Windows endpoints and servers by May 12 and follow cloud-specific guidance where applicable.
- Adversaries and threat actors: The reporting notes that threat actors are also actively exploiting three recently disclosed Windows vulnerabilities—dubbed BlueHammer, RedSun, and UnDefend—in attacks aimed at gaining SYSTEM or elevated administrator privileges, with RedSun and UnDefend still awaiting patches.
Vendor communication and unanswered specifics
Microsoft has been quoted in advisories that describe the exploitation risk and potential for sensitive information disclosure, but a Microsoft spokesperson had not replied to a second email requesting more information about the CVE-2026-32202 attacks, including whether APT28 hackers also exploited this zero-click vulnerability. The question of whether the same APT28 operations that used CVE-2026-21510 in December 2025 also leveraged CVE-2026-32202 therefore remains explicitly unconfirmed in the available reporting.
The sequence of events — a February fix for CVE-2026-21510, Akamai's Thursday report identifying the residual authentication coercion flaw, CERT‑UA's December 2025 attribution to APT28, and CISA's May 12 patch deadline — compresses multiple timelines into an urgent operational demand: federal endpoints must be addressed within days, and all security teams have been told to act swiftly. Whether additional exploit evidence will surface or vendor guidance will change before May 12 is the immediate practical question left open by the record.
Source: BleepingComputer
