Microsoft Zero-day: The Risk of the Faulty Patch Revealed

Discover the impact of the faulty Microsoft patch that left a new zero-click backdoor in Windows Shell. What to know about CVE-2026-32202.

On April 29, 2026, Microsoft and CISA warned that attackers are actively exploiting a new zero-click Windows Shell vulnerability, tracked as CVE-2026-32202. This flaw represents the direct outcome of an incomplete fix for a previous vulnerability, previously abused by Russian spies. The attempt to resolve the initial flaw effectively opened a new authentication coercion backdoor, exposing systems to high risks of network spoofing.

The boomerang effect of the incomplete fix in Windows Shell

The recent CVE-2026-32202 vulnerability has a particularly insidious origin: it is not an isolated flaw, but the direct result of a partial correction. As highlighted by sources, "The flaw stems from an incomplete fix for an earlier vulnerability found and abused by Russian spies a month before Redmond released a patch." This means that Microsoft's efforts to mitigate a pre-existing threat inadvertently introduced a new attack vector.

The new Windows Shell vulnerability is classified as an authentication coercion flaw. By exploiting this flaw, an attacker can expose sensitive information through network spoofing, manipulating the operating system's authentication mechanisms. The zero-click nature of the vulnerability makes the attack particularly dangerous, as it requires no interaction from the target user to be successfully executed.

The structural problem underlying this flaw lies in the application's security logic. Analyzing the flaw, Sophos experts pointed out that "The issue stems from the application’s reliance on untrusted inputs when making security decisions". Relying on unverified inputs for critical security decisions is exactly the weakness that allowed the creation of this new backdoor.

The original vector: OLE bypass and targeted APT28 attacks

To understand the extent of the boomerang effect, it is necessary to analyze the timeline of vulnerabilities. On January 26, 2026, Microsoft had released an out-of-band security update for the Microsoft Office vulnerability tracked as CVE-2026-21509, which was already being actively exploited at the time. This flaw was a security feature bypass vulnerability that allowed bypassing Office's OLE protections.

The attackers' response was rapid. The APT28 group, also known as Fancy Bear, began exploiting CVE-2026-21509 on January 29, 2026, just three days after the patch was released. The Russian hackers weaponized the Office bug in just 3 days, demonstrating exceptionally rapid operational capability. The targeted attacks, conducted via RTC documents, hit targets in Ukraine, Slovakia, and Romania.

The attacks that exploited CVE-2026-21509 included the use of specific malware to maximize impact. Among these, MiniDoor was used to steal email data from Outlook, while PixyNetLoader was used to load a Covenant C2-based payload, thus establishing persistent control over compromised systems. The deadline for remediating this vulnerability by civilian federal agencies, imposed by CISA, was set for February 16, 2026.

Multiple exploit chains and temporal discrepancies

The incident analysis reveals a complex exploit chain that questions the effectiveness of the patch-and-pray model. The April vulnerability is not an isolated case, but fits into a series of interconnected flaws. According to ICT Security Magazine, the vulnerability is linked to two previous CVEs, namely CVE-2025-14174 and CVE-2025-43529, patched in December 2025. This suggests a multiple exploit chain where attackers combined different flaws to bypass modern defenses.

However, the sources present a significant temporal discrepancy that complicates the reconstruction of events. Source 1 states that the previous vulnerability was found and abused "a month before" Microsoft's patch, released on January 26, 2026. However, Sources 4 and 5 indicate that APT28 initiated massive exploitation on January 29, 2026, which is after the patch was released. This divergence suggests that the flaw may have been stealthily exploited before the fix and massively exploited afterward, or that there is a timeframe that is not entirely clear in the initial phases of the attack.

Furthermore, Source 1 does not explicitly specify whether the mentioned previous vulnerability is exactly Office's CVE-2026-21509 or another related Windows flaw. This contextual gap leaves open the possibility that the transition from the February Office exploit to the April Windows Shell flaw occurs through an intermediate vector not yet fully mapped in the available public sources.

Patch management and the context of April 2026

The issue of CVE-2026-32202 fits into the broader context of Microsoft security in the spring of 2026. During the April 2026 Patch Tuesday, Microsoft released a significant volume of fixes, estimated between 167 and 168 resolved vulnerabilities, excluding previous fixes for platforms like Mariner, Azure, Bing, and Microsoft Edge vulnerabilities managed by Google. Among these, there were eight critical vulnerabilities, seven of which were related to remote code execution and one to denial of service.

Similarly, the update cycle saw the patching of an actively exploited zero-day in SharePoint Server, confirming continued pressure on enterprise infrastructures. To manage these threats, tools like Microsoft Defender Vulnerability Management temporarily assign internal labels, such as "TVM-XXXX-XXXX", to zero-day vulnerabilities before an official CVE ID is assigned, still ensuring traceability for security teams.

The incident demonstrates how organizations must address not only the timely application of patches but also confidence in their effectiveness. An incomplete fix not only leaves the system exposed but can provide a false sense of security, turning the remediation process into a potential vector of compromise.

Frequently asked questions

What is the CVE-2026-32202 vulnerability?: It is a zero-click Windows Shell vulnerability classified as authentication coercion. It allows attackers to expose sensitive information through network spoofing without requiring user interaction.
Why is CVE-2026-32202 referred to as a faulty patch?: The vulnerability stems from an incomplete fix of a previous bug. The attempt to resolve the initial flaw left a backdoor due to the application's reliance on untrusted inputs for security decisions.
How is the original CVE-2026-21509 vulnerability exploited?: CVE-2026-21509 is a security feature bypass vulnerability in Microsoft Office that bypasses OLE protections. It was exploited by the Russian APT28 group to launch malware such as MiniDoor and PixyNetLoader via RTC documents.

This article is a synthesis based exclusively on the listed sources.