{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-0000c335665b","releaseDate":"2026-04-14T07:00:00-07:00","cveNumber":"CVE-2026-32202","cveTitle":"Windows Shell Spoofing Vulnerability","releaseNumber":"2026-Apr","vulnType":"Security Vulnerability","latestRevisionDate":"2026-08-21T07:00:00-07:00","description":"<p>Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.</p>\n","cweList":["CWE-693: Protection Mechanism Failure"],"cweDetailsListForSearch":["cwe: CWE-693: Protection Mechanism Failure","cweUrl: https://cwe.mitre.org/data/definitions/693.html"],"unformattedDescription":"Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.","mitreText":"CVE-2026-32202","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-32202","publiclyDisclosed":"No","exploited":"Yes","latestSoftwareReleaseId":0,"latestSoftwareRelease":"Exploitation Detected","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Windows Shell","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000008,"impact":"Spoofing","langCode":"en-US","baseScore":"4.3","temporalScore":"4.0","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-693: Protection Mechanism Failure","https://cwe.mitre.org/data/definitions/693.html"]}],"articles":[{"title":"Windows Shell Spoofing Vulnerability","articleType":"100000000","description":"<p>Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L),but lead to no loss of availability (A:N) and integrity (I:N)? What does that mean for this vulnerability?</strong></p>\n<p>An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality) but not all resources within the impacted component may be divulged to the attacker. The attacker cannot make changes to disclosed information (Integrity) or limit access to the resource (Availability).</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?</strong></p>\n<p>An attacker would have to send the victim a malicious file that the victim would have to execute.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-32202","version":1,"revisionDate":"2026-04-14T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"b0682f10-1127-f111-939a-000d3ac5fb71"},{"cveNumber":"CVE-2026-32202","version":1.1,"revisionDate":"2026-04-27T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Corrected the Exploitability Index, Exploited flag and CVSS vector which was incorrect at the time of publication on 4/14/2026. This is an informational change only.</p>\n","unformattedDescription":"Corrected the Exploitability Index, Exploited flag and CVSS vector which was incorrect at the time of publication on 4/14/2026. This is an informational change only.","notificationNeeded":true,"notificationSent":true,"sourceId":"781d2b8d-7d42-f111-939a-000d3ac5fb71"},{"cveNumber":"CVE-2026-32202","version":2,"revisionDate":"2026-07-28T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>This CVE has been re-released to comprehensively address the vulnerability identified by CVE-2026-32202. Microsoft recommends installing the July 2026 updates for your Windows operating systems.</p>\n","unformattedDescription":"This CVE has been re-released to comprehensively address the vulnerability identified by CVE-2026-32202. Microsoft recommends installing the July 2026 updates for your Windows operating systems.","notificationNeeded":true,"notificationSent":false,"sourceId":"657bb6cd-e88a-f111-93fe-000d3afbc7d7"},{"cveNumber":"CVE-2026-32202","version":2.1,"revisionDate":"2026-08-21T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Updated an acknowledgement. This is an informational change only.</p>\n","unformattedDescription":"Updated an acknowledgement. This is an informational change only.","notificationNeeded":false,"notificationSent":false,"sourceId":"e2d219b2-5d9d-f111-93fe-000d3afbc7d7"}]}