CISA Warns of Actively Exploited Windows Vulnerability CVE-2026-32202

CISA has added a new Windows vulnerability to its Known Exploited Vulnerabilities catalog. The vulnerability, tracked as CVE-2026-32202, is an NTLM hash leak that can be triggered without any user interaction. Microsoft has released a security update to address the issue.

CISA adds CVE-2026-32202 to exploited vulnerabilities catalog

The vulnerability affects Windows systems and allows an attacker to leak NTLM hashes remotely. CISA requires federal agencies to apply the patch within a short timeframe. The agency's catalog includes vulnerabilities that are known to be actively exploited in the wild.

It remains unclear how many systems have been successfully protected against this vulnerability. Security researchers from Akamai and other organizations have been tracking the issue. The vulnerability was disclosed through multiple security outlets including BleepingComputer and Help Net Security.

Microsoft has not confirmed the full scope of affected systems. Organizations are advised to apply the security update as soon as possible to mitigate the risk of exploitation.