A security researcher has disclosed a spoofing vulnerability in Windows that lets attackers capture NTLMv2 password hashes with zero user interaction. All it takes is a malicious .lnk file placed in a folder — when someone opens File Explorer to view the folder, Windows automatically sends an authentication request to an attacker-controlled SMB server.
The vulnerability, tracked as CVE-2026-32202, affects Windows 11 (23H2, 24H2, 25H2, 26H1), Windows 10 (21H2-22H2), and Windows Server 2019/2022/2025. The attack vector is via network SMB, requires no privileges, and needs zero clicks — just opening the folder triggers the leak.
The CVSS score is 4.3 (Medium). The researcher, nu11secur1ty, published proof-of-concept exploit code on Exploit-DB that generates a LNK file with a UNC path pointing to the attacker’s server. From there, tools like Responder or Impacket intercept the NTLM hash when the victim simply views the folder in File Explorer.
Microsoft addressed this in its April 2026 Patch Tuesday update (KB2026-04214). If you haven’t applied that patch yet, now would be a good time.
