NewsPublished 27 Apr 2026

Incomplete Windows Patch Opens Door to Zero-Click Attacks

Source SecurityWeek

Mentions 2 CVEs

Mentioned vulnerabilities

Description

The initial vulnerability was exploited by Russia-linked APT28 in attacks against Ukraine and EU countries. The post Incomplete Windows Patch Opens Door to Zero-Click Attacks appeared first on SecurityWeek .

Impact

Exploitation of these vulnerabilities enables remote code execution and credential theft without user interaction, allowing attackers to execute arbitrary code and steal authentication hashes. This facilitates further attacks such as NTLM relay and offline password cracking. The threat actor APT28 used these vulnerabilities in targeted attacks against Ukraine and EU countries. The incomplete patch initially left systems vulnerable to zero-click attacks, increasing the risk of stealthy compromise and credential exposure.

Defensive guidance

Microsoft released official patches for CVE-2026-32202 in April 2026, addressing the incomplete patch issue and mitigating the zero-click attack vector. Systems should be updated with the April 2026 security patches to fully remediate these vulnerabilities. No additional mitigation actions are indicated beyond applying the official fixes.

References

securityweek.com/incomplete-windows-patch-opens-door-to-zero-click-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Apr 2026, 13:15 UTC

References

Community reviews

Related threats