CVE-2026-32202: Which Endpoints in Your Fleet Still Lack the Patch?
CVE-2026-32202 is an actively exploited zero-click NTLM vulnerability targeted by APT28. The CISA Known Exploited Vulnerabilities deadline for this flaw expired May 12, 2026, making urgent private-sector action critical alongside federal agency requirements.
How the Vulnerability Works
The flaw enables attackers to capture NTLM credential hashes when users simply open folders containing malicious shortcut files. The system automatically sends Net-NTLMv2 hashes to attacker-controlled servers — no user interaction required.
Importantly, Microsoft’s February 2026 patch for the related vulnerability CVE-2026-21510 proved incomplete. CVE-2026-32202 represents a bypass of that fix, requiring the April corrective update to fully remediate the exposure.
Identifying Unpatched Endpoints with CapaOne
CapaOne’s Security Monitor continuously maps vulnerability exposure across all endpoints in your fleet. It identifies which devices still lack the April patch through a prioritized dashboard filterable by:
- Severity
- Device group
- Site
- Business unit
This eliminates the need for manual spreadsheet cross-referencing and gives IT teams an immediate, actionable view of their exposure.
Reducing the Blast Radius
Even when credentials are captured, Privilege Manager limits the damage by eliminating standing administrator rights. Elevation is:
- Granted selectively and on demand
- Time-limited
- Fully logged for audit purposes
A compromised standard-user account is far less dangerous when it cannot escalate privileges silently.
Compliance Documentation
CapaOne generates exportable CSV evidence to support NIS2 Article 21 compliance requirements and cyber insurance questionnaires — with no additional manual extraction needed.
Ready to see how CapaOne handles this? Request a demo.
