FILE Windows Shell Spoofing Vulnerability (CVE-2026-32202)

Rule ID

1238218

Severity

High

Description

An LNK file using a particular CLSID can trigger a remote 0-click NTLM disclosure just by viewing the file in a File Explorer window. The disclosure of the user's NTLMv2 credentials occurs over SMB to an attacker controlled UNC.

Impact

Policy bypass

Recommendation

Update vendor's patch.

IPS Category

File vulnerabilities

IPS Anomaly Group

N/A

IPS Rule Default Action

Deny

References

Keywords

Windows Server 2012, Windows Server 2016, Windows Server 2019