CVE-2026-32225: Windows Shell Security Feature Bypass Vulnerability

CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 1.20% probability of exploitation activity in the next 30 days, higher than 68% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday, delivered through 11 security updates (KB5082123, KB5082142, KB5082200, KB5082063 and more). It affects 31 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2026-32225

Severity

High CVSS 8.8

Microsoft severity

Important

Impact

Security Feature Bypass

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

More Likely

Weakness

CWE-693

EPSS

1.20% (percentile 68%)

CISA KEV

Not listed

Released

14 April 2026

Last updated

14 April 2026

Patch Tuesday

April 2026 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2026-32225 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Description

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Frequently asked questions (Microsoft)

What kind of security feature could be bypassed by successfully exploiting this vulnerability?

This vulnerability could allow an attacker to bypass SmartScreen protections that rely on the Mark of the Web (MotW) to identify files originating from the internet.

How could an attacker exploit this vulnerability?

An attacker could exploit this issue by convincing a user to open a specially crafted .lnk file delivered through email, a website download, or removable media. When opened, the shortcut causes Windows to launch commands or Control Panel applets without proper MotW handling, potentially allowing arbitrary command execution or loading attacker‑controlled DLLs.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

To successfully exploit this vulnerability, an attacker must convince a user to open a malicious link or shortcut file.

Affected products (31)

Windows

ESU

Security updates (11)

• KB5082123 (Security Update)
• KB5082142 (Security Update)
• KB5082200 (Security Update)
• KB5082063 (Security Update)
• KB5083769 (Security Update)
• KB5082052 (Security Update)
• KB5082060 (Security Update)
• KB5082198 (Security Update)
• KB5082127 (Monthly Rollup)
• KB5082126 (Monthly Rollup)
• KB5083768 (Security Update)

NIST NVD data

NVD status

Analyzed

NVD CVSS

8.8 (HIGH)

NVD weakness

CWE-693

Published to NVD

14 April 2026

NVD last modified

17 April 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32225 (Vendor Advisory)

Acknowledgments

• Jeong Lee with Microsoft

Revision history

Related vulnerabilities

Other Windows Shell vulnerabilities

• CVE-2026-83782: Windows Shell Remote Code Execution Vulnerability (Critical, CVSS 9.8, October 2026)
• CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability (High, CVSS 8.8, exploited, October 2026)
• CVE-2026-85936: Windows Shell Remote Code Execution Vulnerability (High, CVSS 8.8, October 2026)
• CVE-2026-83876: Windows Shell Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-83873: Windows Shell Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-70222: Windows Shell Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-83906: Windows Shell Spoofing Vulnerability (Medium, CVSS 6.5, October 2026)
• CVE-2026-83905: Windows Shell Information Disclosure Vulnerability (Medium, CVSS 4.7, October 2026)
• CVE-2026-69829: Windows Shell Remote Code Execution Vulnerability (Critical, CVSS 9.8, September 2026)
• CVE-2026-70563: Windows Shell Spoofing Vulnerability (High, CVSS 8.1, September 2026)
• CVE-2026-69606: Windows Shell Elevation of Privilege Vulnerability (High, CVSS 7, September 2026)
• CVE-2026-69528: Windows Shell Elevation of Privilege Vulnerability (High, CVSS 7.8, September 2026)

More from the April 2026 Patch Tuesday

• CVE-2026-32202: Windows Shell Spoofing Vulnerability (Medium, CVSS 4.3, exploited)
• CVE-2026-33824: Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2026-32162: Windows COM Elevation of Privilege Vulnerability (High, CVSS 8.4)
• CVE-2026-33826: Windows Active Directory Remote Code Execution Vulnerability (High, CVSS 8)
• CVE-2026-27909: Windows Search Service Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27914: Microsoft Management Console Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32152: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32154: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27913: Windows BitLocker Security Feature Bypass Vulnerability (High, CVSS 7.7)
• CVE-2026-26151: Remote Desktop Spoofing Vulnerability (High, CVSS 7.1)
• CVE-2026-27908: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2026-27921: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)

All vulnerabilities of this release: April 2026 Patch Tuesday · April 2026 briefing

Sources

• Microsoft Security Update Guide: CVE-2026-32225
• NIST NVD: CVE-2026-32225
• CVE.org record: CVE-2026-32225