Windows zero-day CVE-2026-32202 confirmed as exploited

[Redaktion]

CISA has ordered federal agencies to patch CVE-2026-32202, a zero-click Windows Shell flaw left open by an incomplete February fix now confirmed as exploited.

https://www.notebookcheck.net/Windows-zero-day-CVE-2026-32202-confirmed-as-exploited.1285559.0.html

[GeorgeS]

So like the user has to be tricked or otherwise download & install a malicious shortcut file that when simply rendered by File Explorer (if the user is connected to the internet) may set off a chain reaction on the users PC.

"Bad Actors" would need to insert or otherwise infect items that is attractive to the user to download & install.