CISA has mandated federal agencies to patch a critical Windows zero-day vulnerability (CVE-2026-32202) by May 12, as it's actively exploited to leak NTLM hashes, posing a significant risk to government systems.
This zero-click NTLM hash leak vulnerability allows attackers to gain sensitive information and perform 'pass-the-hash' attacks, enabling lateral movement and data exfiltration within compromised networks.
While a previous related flaw was exploited by a state-sponsored group, the current exploitation's origin is unconfirmed, yet CISA urges all organizations to prioritize patching to prevent widespread security breaches.

Atlas AI
The U. S.
Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to patch a Windows vulnerability, CVE-2026-32202, actively exploited in zero-day attacks. This directive requires Federal Civilian Executive Branch (FCEB) agencies to implement the patch by May 12.
The vulnerability is a zero-click NTLM hash leak, stemming from an incomplete patch for a prior remote code execution flaw (CVE-2026-21510). Exploitation allows attackers to view sensitive information and conduct pass-the-hash attacks, leading to lateral movement and data exfiltration.
While the previous flaw (CVE-2026-21510) was exploited by a state-sponsored cyberespionage group against Ukraine and EU countries, there is no confirmed link between this group and the current CVE-2026-32202 exploitation. CISA has emphasized that this type of vulnerability poses significant risks to federal enterprises.
All organizations are urged to prioritize patching this vulnerability to mitigate potential security risks. This action aligns with Binding Operational Directive (BOD) 22-01, which governs the remediation of known exploited vulnerabilities within federal systems.
Related Articles

Trump Administration Moves to Force Most Green-Card Applicants Overseas
22 May, 18:41·about 8 hours ago
Gabbard’s Exit Exposes Divisions Inside Trump’s Security Apparatus
22 May, 18:31·about 8 hours ago