CVE-2026-21510Active Exploitation(microsoft / windows_10_1607)

The second vulnerability (CVE-2026-21510) bypasses security features such as the Microsoft Defender SmartScreen and executes attacker-controlled code, which is stored on the attacker's remote server. An incomplete patch for CVE-2026-21510 (an #APT28 exploit) created a new zero-click vulnerability: CVE-2026-32202. https://www.akamai.com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-32202

It seems to me that Microsoft just issued additional 3 patches to address the weaknesses in the original Office CVE-2026-21509/zero-day exploit chain. Microsoft Word Security Feature Bypass Vulnerability (CVE-2026-21514) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514 Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 MSHTML Framework Security Feature Bypass Vulnerability (CVE-2026-21513) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513 Microsoft Office Security Feature Bypass Vulnerability (CVE-2026-21509) - the original one https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

‼️ CISA has added 6 vulnerabilities to the KEV Catalog CVE-2026-21513: Microsoft Internet Explorer Protection Mechanism Failure Vulnerability: Microsoft Internet Explorer contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally. CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability: Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability: Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally. CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability: Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally. CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability: Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.

🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗙𝗲𝗯𝗿𝘂𝗮𝗿𝘆 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 February brings 𝟲 𝗮𝗰𝘁𝗶𝘃𝗲𝗹𝘆 𝗲𝘅𝗽𝗹𝗼𝗶𝘁𝗲𝗱 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀, primarily focused on security feature bypass and privilege escalation. 𝗧𝗿𝗮𝗰𝗸𝗲𝗱 𝗖𝗩𝗘𝘀: 🔸 CVE-2026-21514 🔸 CVE-2026-21510 🔸 CVE-2026-21513 🔸 CVE-2026-21525 🔸 CVE-2026-21533 🔸 CVE-2026-21519 Multiple SYSTEM-level 𝗲𝗹𝗲𝘃𝗮𝘁𝗶𝗼𝗻-𝗼𝗳-𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 issues and 𝘂𝘀𝗲𝗿-𝗶𝗻𝘁𝗲𝗿𝗮𝗰𝘁𝗶𝗼𝗻 𝗱𝗼𝗰𝘂𝗺𝗲𝗻𝘁 𝗮𝘁𝘁𝗮𝗰𝗸𝘀 are already being exploited in the wild — making endpoint patch prioritization critical. 𝗙𝘂𝗹𝗹 𝗯𝗿𝗲𝗮𝗸𝗱𝗼𝘄𝗻 and insights available in this month’s 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁: 🔗 https://horizon-secured.com/newsletter/ #HorizonAlert #Cybersecurity #PatchTuesday #ZeroDay

Theo 这张清单刷屏了，近期的安全事件如下： CopyFail（Linux 系统被破解） CopyFail 2/Dirty Frag（Linux 内核脏碎片漏洞） Next.js 框架出现 13 个安全警告 MacOS 26.5 系统修复了 70 多个通用漏洞披露（CVE）漏洞 iOS 26.5 系统修复了约 50 个通用漏洞披露（CVE）漏洞 YellowKey（Windows Bitlocker 全盘加密被破解） GreenPlasma（Windows 权限提升漏洞） CVE-2026-21510 和 CVE-2026-21513 被证实由俄罗斯用于 Windows 远程代码执行漏洞攻击 CVE-2026-32202 被单独证实由俄罗斯用于获取敏感文档 Mini-Shai Hulud（超过 300 个 JS 和 Python 软件包因 GitHub Action 缓存投毒而被入侵） 谷歌证实，他们发现了利用人工智能对某个未知的 “开源、基于 Web 的系统管理工具” 进行零日漏洞攻击的情况 Canvas（大多数学校使用的流行学习管理系统）被完全破解 PAN-OS（ Palo Alto Networks 公司的操作系统）因严重等级为 9.3 的 CVE-2026-0300 漏洞被破解 我连着看了三天相关报告，越看越觉得这不是个危言耸听的恐怖故事， 更像是软件工程进入后AI安全时代的入学通知。 最关键的信号藏在 CopyFail 里： 一个 732 字节的 Python 脚本， 确定性拿下 2017 年后几乎所有 Linux 发行版的 root。 这玩意竟然是 AI 辅助发现的。 Google 也在同一周确认，AI 驱动的零日已经在野利用了， 俄罗斯 APT 直接武器化两个 Windows CVE， Mini-Shai Hulud 一次劫持 300+ 个 JS/Python 包。 以前一个漏洞躺三年才被人发现， 现在 AI 扫描+AI 利用，未知→已知→武器化几乎同步发生。 更狠的是供应链， Mini-Shai Hulud 告诉所有人一件事: 你信任的 CI/CD 才是最大的后门。 你以为用官方 GitHub Action 就安全, 其实是把 OIDC token 的钥匙拱手送给攻击者。 Perry Metzger 说过一句我反复琢磨的话： bug 的总量是有限的,AI 正在快速耗尽低挂果实。 也就是说,以前安全是"被动 patch", 现在开始转向"AI 实时免疫"。 未来不再是人盯人,会变成 AI 盯 AI。 所以 Theo 问 Are you scared yet, 我的答案是不怕,但必须立刻行动。 第一步不是全站 patch,是把供应链审计提到 P0， GH Actions 全审一遍,禁用 pull_request_target, 强制 SLSA Level 3,启用 SBOM。 那些把"安全作为第一原则"写进 DNA 的团队, 接下来 3-5 年会活得最舒服， 其他人要交的学费,可能比想象中贵得多~

米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（2/10追加） 🛡️No.1509 CVE-2026-21510 Microsoft Windows Shell Protection Mechanism Failure Vulnerability ============= CVSSスコア： 8.8 (Base) / Microsoft Corporation CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 種別：保護メカニズムの不具合 (CWE-693 / Microsoft Corporation) 深刻度：重要 ---------------------- 悪用時影響： 事前認証されていない攻撃者により、悪意のあるリンクやショートカットファイルを介して、リモートよりWindows SmartScreen および Windows Shell のセキュリティプロンプトをバイパスされる恐れがあります。 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 🛡️No.1510 CVE-2026-21513 Microsoft MSHTML Framework Security Feature Bypass Vulnerability ============= CVSSスコア： 8.8 (Base) / Microsoft Corporation CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 種別：保護メカニズムの不具合 (CWE-693 / Microsoft Corporation) 深刻度：重要 ---------------------- 悪用時影響： 事前認証されていない攻撃者により、細工されたHTMLファイルやショートかっとファイルを介して、リモートから、セキュリティ機能をバイパスされる恐れがあります。 https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513 🛡️No.1511 CVE-2026-21514 Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability ============= CVSSスコア： 7.8 (Base) / Microsoft Corporation CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 種別：セキュリティ決定の信頼できない入力への依存 (CWE-807/ Microsoft Corporation) 深刻度：重要 ---------------------- 悪用時影響： 認証済みの攻撃者により、Officeファイルを介してローカル上でSYSTEＭ権限を取得される恐れがります。 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514 🛡️No.1512 CVE-2026-21519 Microsoft Windows Type Confusion Vulnerability ============= CVSSスコア： 7.8 (Base) / Microsoft Corporation CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 種別：型の取り違え (CWE-843/ Microsoft Corporation) 深刻度：重要 ---------------------- 悪用時影響： 認証済みの攻撃者により、ローカル上でSYSTEM権限を取得される恐れがあります。 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519 🛡️No.1513 CVE-2026-21525 Microsoft Windows NULL Pointer Dereference Vulnerability ============= CVSSスコア： 6.2 (Base) / Microsoft Corporation CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 種別：NULL ポインタデリファレンス (CWE-476 / Microsoft Corporation) 深刻度：注意 ---------------------- 悪用時影響： 事前認証されていない攻撃者により、ローカル上でDoSを発生させられる恐れがあります。 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 🛡️No.1514 CVE-2026-21533 Windows Remote Desktop Services Elevation of Privilege Vulnerability ============= CVSSスコア： 7.8 (Base) / Microsoft Corporation CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 種別：不適切な権限管理 (CWE-269 / Microsoft Corporation) 深刻度：深刻🔥 ---------------------- 悪用時影響： 認証済みの攻撃者により、ローカル上でSYSTEM権限を取得される恐れがあります。 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533 CISA Adds Six Known Exploited Vulnerabilities to Catalog | CISA https://www.cisa.gov/news-events/alerts/2026/02/10/cisa-adds-six-known-exploited-vulnerabilities-catalog #vulnerability

Micropatches released for Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) https://blog.0patch.com/2026/04/micropatches-released-for-windows-shell.html https://t.co/hp1PpYcgBB

⚠️ Vulnerabilidades en productos Microsoft ❗ CVE-2026-24300 ❗ CVE-2026-21510 ❗ CVE-2026-20841 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-microsoft-5/ https://t.co/hlwmGgx7eh

🔥 Recap cybersec de la semaine (9-15 fév) : 🚨 Patch urgents : • Microsoft : 6 zero-days exploités (CVE-2026-21510/13/14) • Apple : CVE-2026-20700 exploitée en conditions réelles • CISA ajoute 10 vulnérabilités au catalogue KEV • BeyondTrust CVE-2026-1731 : RCE critique non authentifiée 💥 Incidents majeurs : • Conduent : 25M d'Américains affectés (données Medicaid) • Telegram : +200M d'enregistrements exposés • Harvard : 115K dossiers compromis (ShinyHunters) 🤖 Menaces IA : • Assistants de codage IA copient du code vers la Chine • LLM de plus en plus efficaces pour exploiter les vulns • +300 extensions Chrome malveillantes (37M téléchargements) 🔓 Supply chain : • Notepad++ backdoorisé + compromis par APT chinois • Microsoft donne les clés BitLocker au FBI #cybersecurity #infosec #zerodayupdates

Hmm. This was a pretty nice 0day for some group. (As far as vulns requiring users to click on files go, anyway.) Results in LNK attacks being turbocharged by bypass of even execution prompts/warnings. (Already too easy to fool users into clicking LNKs.) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 https://t.co/dIvb33ZSAC

CVE-2026-32202: The Trust Check Runs at the Click. The Coercion Runs at the Icon PT ID: PT-2026-32854 Akamai researchers analyzed the Windows Shell vulnerability CVE-2026-32202 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-32202), which resulted from an incomplete fix for the previously exploited CVE-2026-21510 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-21510). In February 2026, Microsoft patched the remote code execution vector by enforcing SmartScreen trust verification before executing Control Panel applets, but one issue went unnoticed: Explorer still automatically connects to an attacker’s SMB server when displaying a folder’s contents. The Microsoft patch moved the trust verification ("ControlPanelLinkSite", "IVerifyingTrust::OnVerifyingTrust") only to the execution stage via "ShellExecuteExW", but didn’t fix the execution path during enumeration, tooltip display, or preview. Because of a bug in "shell32.dll", the "_IDCONTROLW" structure for Control Panel items ("Control Panel applet") can trigger a call to "PathFileExistsW" by viewing a folder containing a ".lnk" file. This causes Explorer to initiate an SMB connection and leak the NTLMv2 hash before any user interaction and regardless of SmartScreen. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-32854 • https://nefariousplan.com/posts/cve-2026-32202-trust-check-at-the-click • https://github.com/virus-or-not/CVE-2026-32202 #dbugs_attacks

⚙️ القصة من البداية: في ديسمبر 2025، استهدفت (APT28) أجهزة ويندوز بملف اختصار خبيث. لما يقرأه الويندوز، يحسبه جزء من لوحة التحكم (Control Panel) ويشغّل ملف (DLL) من سيرفر المخترق مايكروسوفت قفلت الثغرة (CVE-2026-21510) في فبراير 2026.. بس الترقيع كان ناقص وتسبب بثغره ثانيه ! 2/5 https://t.co/mL5mViYzZt

CISA mandates federal agencies to patch a Windows zero-click vulnerability CVE-2026-32202 by May 12 under BOD 22-01. The flaw connects to APT28 and follows an incomplete Microsoft fix for CVE-2026-21510. #CVE2026 #APT28 #USA https://ift.tt/4mC6vhx

Destaca la brecha crítica CVE-2026-21510, que permite evadir las alertas de seguridad de Windows Shell. Se requiere el despliegue inmediato de parches en todos los clientes de red (MSRC/Rapid7).

5 breaches making headlines: 1. Warlock ransomware hit SmarterTools via unpatched SmarterMail (CVE-2026-23760) 2. China-linked UNC3886 targeting Singapore telecom with zero-days 3. Microsoft Windows Shell zero-day (CVE-2026-21510) actively exploited databreach. 1/2

Microsoft recently updated its advisory for CVE-2026-32202, confirming that this Windows Shell flaw is now being actively exploited in the wild. While originally labeled as a "spoofing" vulnerability with a lower severity score, new research has revealed it is a critical link in an exploit chain used by nation-state actors. Technical Overview: CVE-2026-32202 is an authentication coercion vulnerability. It stems from an "incomplete patch" for a previous flaw (CVE-2026-21510) that was weaponized by the Russian threat group APT28 (also known as Fancy Bear). 1- The Mechanism: The flaw exists in how the Windows Shell parses namespace objects, specifically Control Panel (.CPL) files. 2- The Attack: An attacker can craft a malicious shortcut file (.LNK) or a web link that points to a remote server using a UNC path (e.g., \\attacker-server\share\payload.cpl). 3- The Flaw: When Windows Shell attempts to resolve this path to display the file's icon or properties, it automatically initiates an SMB connection. 4- The Consequence: This triggers an automatic NTLM authentication handshake. The victim's machine sends its Net-NTLMv2 hash to the attacker’s server without any user interaction (Zero-Click). Why It’s Dangerous: While the vulnerability itself is rated CVSS 4.3 (Medium) because it only "discloses information," its role in real-world attacks is far more severe: 1- Credential Theft: Attackers capture your NTLM hashes to crack them offline or use them in NTLM Relay attacks to impersonate you on other parts of the network. 2- Zero-Click Vector: In certain scenarios (like viewing a folder containing a malicious .LNK file), the exploitation happens automatically as Windows tries to "preview" the file. 3- Nation-State Activity: Its active use by APT28 suggests it is being used for high-value espionage and lateral movement within corporate and government networks. Affected Systems: The flaw affects nearly all modern versions of Windows, including: 1- Windows 10 & 11 (all recent versions, including 24H2 and 26H1). 2- Windows Server (2012 through 2025). Mitigation and Action Plan: Microsoft released a patch for this as part of the April 2026 Patch Tuesday updates. If you haven't updated since mid-April, your system is likely vulnerable.

CVE-2026-21510: Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

@the_yellow_fall Fancy Bear. zero-click. NTLM theft. original patch wasn't enough. this is the same class of bug as CVE-2026-21510 - Windows Shell keeps handing APT28 new keys. how many times do we patch the same mistake? http://vulntracker.io

An incomplete Windows patch for SmartScreen and Shell prompts enabled zero-click attacks using malicious LNK and HTML files, exploited by Russia-linked APT28 via CVE-2026-21513 and CVE-2026-21510. #APT28 #WindowsPatch #Russia https://ift.tt/skQF4nJ

CVE-2026-21510 allowed malicious Windows shortcuts to execute remote DLLs without security warnings, bypassing mark-of-the-web protections. 0patch releases micropatches for legacy Windows systems after wild exploitation confirmed. #DFIR_Radar https://t.co/eJkqChik9X