CVE-2026-32202Vulnerability
Microsoft Windows Protection Mechanism Failure Vulnerability
Reported by 3 independent sources · first reported by Tenable · last reported
Last reported 4 days ago
Fix due 12 May 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 92% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
4 reports, newest first · the exact sentence from each-
Incomplete security patches show hackers where to look next“Microsoft fixed the bypass in April as CVE-2026-32202, and that flaw also ended up on CISA’s exploited list.”
-
Security patches need patches now that attackers have AI“Redmond’s patch, however, was incomplete, and left a second flaw - a zero-click authentication coercion vulnerability (CVE-2026-32202) - that was also found and abused before Microsoft fixed it in April.”
-
Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)““The other two were CVE-2026-21510, which is linked to the advanced persistent threat group APT28 (also known as Fancy Bear), and CVE-2026-32202, which was a fix for an incomplete patch for CVE-2026-21510.”
-
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)“…hird flaw in Windows Shell that was exploited in the wild in 2026: CVE-2026-21510 was patched in February 2026’s Patch Tuesday while CVE-2026-32202 was patched in April 2026’s Patch Tuesday.”
Indicators reported together
named in the same reports- affecting[.]netin 1 report
- malicious[.]netin 1 report
Copy these 2 indicators · defanged
Also named with it: CVE-2026-21510, CVE-2026-96951, CVE-2026-108398, CVE-2026-70571, CVE-2026-70279, CVE-2026-102866, CVE-2026-70229, CVE-2026-35540
Thanks — we review every report.