Windows Shell

CVE-2026-21510 – SmartScreen Security Feature Bypass & Remote Code Execution via Malicious LNK Files

Affects

• Microsoft Windows (Windows Shell / Explorer.exe)
• Versions (pre‑patch, February 2026):
  • Windows 11: 24H2, 23H2, 22H2
  • Windows 10: 22H2, 21H2
  • Windows Server: 2025, 2022, 2019, 2016
• Additional affected products (due to shared components):
  • Microsoft Office 2016/2019/2021
  • Microsoft 365 Apps for Enterprise
  • Microsoft Exchange Server 2016/2019
  • Microsoft SharePoint Server 2016/2019
  • Microsoft Visual Studio 2022
• Components:
  • Windows Shell (shell32.dll)
  • Windows SmartScreen
  • Windows Explorer (explorer.exe)
• Key functions:
  • CShellLink::_LoadFromFile
  • CControlPanelFolder::GetUIObjectOf
  • SmartScreen::ShouldShowWarning

Description

CVE-2026-21510 is a SmartScreen Security Feature Bypass vulnerability in Microsoft Windows Shell that allows remote code execution (RCE) via a specially crafted Windows Shortcut (.lnk) file.

How it works:

When a user downloads a file from the internet, Windows adds a Mark‑of‑the‑Web (MOTW) tag. SmartScreen is designed to display a warning before allowing potentially dangerous files to run.

However, in vulnerable versions of Windows, the Windows Shell processes the shortcut’s icon or target path before checking the MOTW and before SmartScreen evaluation.

Specifically:

• The vulnerable function CControlPanelFolder::GetUIObjectOf in shell32.dll trusts any object that appears to be a Control Panel item (using CLSIDs).
• When a malicious .lnk file points to a specific CLSID (e.g. {8856F961-340A-11D0-A96B-00C04FD705A2} for Shell.Explorer.2), the system treats it as “safe” and bypasses all SmartScreen checks.
• An attacker can embed a UNC path (SMB share) pointing to a malicious DLL, CPL, or executable.
• Because the SmartScreen warning is never displayed, Windows proceeds to:
  • Connect to the attacker’s remote server (SMB on port 445/TCP),
  • Download the malicious payload,
  • Execute it via trusted processes such as control.exe or rundll32.exe – without the user ever seeing a warning.

This results in a one‑click (or even zero‑click in some scenarios) remote code execution with the privileges of the logged‑on user.

Attack Vector

Primary Attack Vector:
Remote via Email / Web Download (Client‑Side)

Attack Scenario (One‑Click RCE):

1. Attacker crafts a malicious .lnk file that:
   • Points to a specific CLSID (Control Panel object) to bypass SmartScreen,
   • Contains a UNC path to a remote SMB server controlled by the attacker,
   • Is configured to launch control.exe or rundll32.exe with the remote payload.
2. Attacker distributes the file via:
   • Phishing email (as an attachment, often inside a ZIP archive),
   • Compromised website (drive‑by download),
   • USB drive (physical access).
3. User opens the folder containing the .lnk file (or double‑clicks it).
4. Windows Explorer processes the shortcut:
   • Because of the CLSID, SmartScreen never displays a warning.
   • The system automatically connects to the attacker’s SMB server (port 445/TCP).
   • The malicious payload is downloaded and executed via control.exe or rundll32.exe.

Attack Scenario (Zero‑Click NTLM Leak – prior to April 2026 patches):
Even without a full RCE, simply having the .lnk file in a folder (e.g. Downloads) could trigger an SMB authentication to the attacker’s server, leaking the user’s Net-NTLMv2 hash.

Key Characteristics:

• One‑click RCE – user only needs to double‑click the file.
• SmartScreen bypass – no warning is ever displayed.
• No privilege escalation needed – runs as the current user (often sufficient for data theft and lateral movement).
• Works over the internet – the SMB share can be hosted anywhere.

Conditions Increasing Risk:

• Windows SmartScreen enabled (default) – bypassed anyway.
• Outbound SMB traffic (port 445/TCP) allowed to the internet (common in unhardened networks).
• User has local admin rights (allows full system compromise).
• No EDR/AV rules specifically targeting .lnk files with UNC paths.

Impact

Successful exploitation allows an attacker who controls a malicious SMB server to:

• Execute arbitrary code on the victim’s machine with the privileges of the logged‑on user,
• Download and install malware (ransomware, info‑stealers, backdoors, Cobalt Strike beacons),
• Steal sensitive data from the local system and accessible network shares,
• Capture Net-NTLMv2 hashes (via SMB authentication) for offline cracking or NTLM relay attacks,
• Move laterally within the corporate network using harvested credentials,
• Establish persistence for long‑term access.

In enterprise environments where the compromised user has administrative privileges (common in poorly secured networks), the attacker may gain full control of the endpoint.

This vulnerability effectively disables the SmartScreen warning – one of Windows’ primary defenses against downloaded malicious files.

Observed Exploitation & Threat Activity

• Disclosed as a zero‑day – actively exploited before the patch was available.
• Associated threat actor: APT28 (Fancy Bear) – used in targeted spear‑phishing campaigns against Ukraine and European government entities .
• Public proof‑of‑concept (PoC) tools emerged rapidly after disclosure (e.g., EpSiLoNPoInTlnk).
• Added to CISA Known Exploited Vulnerabilities (KEV) catalog on February 10, 2026 – requiring federal agencies to patch by March 3, 2026.
• Patch initially released in February 2026 (KB5051987, KB5051989, etc.), but was incomplete (leading to CVE-2026-32202, later fixed in April 2026).
• High risk of widespread exploitation by:
  • Ransomware gangs (to deploy payloads without warnings),
  • Initial access brokers (to bypass user alerts),
  • State‑sponsored actors.

Severity & Metrics

• CVSS v3.1 Score: 8.8 (High)
• Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • Attack Vector: Network (attacker can be remote)
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required (the user must click the .lnk file)
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Relevant CWE:

• CWE-693 – Protection Mechanism Failure
  (SmartScreen should block or warn, but fails to do so due to improper validation timing)

Patch & Vendor Status

• Patch released: February 2026 (Microsoft February Security Update)
  • Windows 11 / 10: KB5051987, KB5051989, KB5051988
  • Windows Server: KB5051974, KB5051979, KB5051980
• Critical Note: The initial patch was incomplete. A second patch was released in April 2026 to fully address related NTLM leak issues (CVE-2026-32202). Organizations should apply both February and April updates.
• Microsoft recommends immediate installation of the cumulative updates for all affected products.
• No other official workarounds fully remediate the vulnerability – patching is the primary solution.

Mitigation & Remediation

Immediate Actions

• Apply the latest Windows cumulative updates (February 2026 + April 2026) on all affected systems .
• If immediate patching is impossible (legacy systems, change control delays), implement compensating controls:
  • Block outbound SMB (port 445/TCP) at the perimeter firewall.
    This prevents the exploit from reaching the attacker’s remote server and stops NTLM hash exfiltration.

    iptables -A OUTPUT -p tcp --dport 445 -d 0.0.0.0/0 -j DROP
    

  • Disable the Preview Pane in File Explorer (Group Policy or manual).
    This reduces the chance of unintended icon loading.
  • Configure Windows to show file extensions – users can then see .lnk extensions more easily.

Defensive Measures

• Enable SMB Signing to prevent NTLM relay attacks if SMB outbound cannot be fully blocked.
• Restrict NTLM authentication using Group Policy:
  • Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers → Deny All
• Use Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint:
  • D4F940AB-401B-4EFC-AADC-AD5F3C50688A – Block all executable files from downloading from email and webmail clients.
  • BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 – Block executable files from running unless they meet a prevalence, age, or trusted list criterion.
  • 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B – Block JavaScript or VBScript from launching downloaded executable content.
• Block .lnk file attachments in email gateways (or at least warn/quarantine).
• Educate users about not opening shortcuts (*.lnk) received from untrusted sources, even if no warning appears.
• Regularly rotate administrative credentials – assume NTLM hashes may have been leaked.

Detection & Hunting

Indicators of Exploitation (IoCs):

• Outbound SMB connections (port 445/TCP) from workstations or servers to untrusted external IP addresses (seen in firewall or NetFlow logs).
• Process anomalies:
  • explorer.exe spawning unexpected child processes: powershell.exe, cmd.exe, rundll32.exe, control.exe, wscript.exe, cscript.exe, mshta.exe.
  • control.exe or rundll32.exe loading files from UNC paths (e.g., \\<IP>\share\*.dll or *.cpl).
• File system events:
  • Creation of .lnk files in Downloads or Temp folders with UNC paths in IconLocation or TargetPath.
  • Presence of Zone.Identifier (MOTW) but no corresponding SmartScreen warning events.
• Network traffic:
  • SMB session setup requests destined to external IPs.
  • Downloads of .dll, .cpl, .exe from SMB shares shortly before process execution.

Log Sources to Monitor:

• Windows Security Event Log: Event ID 4624 (Logon Type 3 – Network), 4688 (Process Creation)
• Microsoft-Windows-SMBClient/Operational: Event ID 1 (SMB connection established), 11 (SMB request)
• Microsoft-Windows-SmartScreen/Operational: Absence of Event ID 1005/1007 for suspicious files is itself suspicious
• Sysmon (if deployed): Event ID 1, 3, 7, 11, 22
• EDR / MDE Advanced Hunting
• Firewall / Proxy logs for port 445/TCP egress

Sample Sigma Rule (Concept):

title: CVE-2026-21510 - Suspicious Child Process from Explorer
id: 7f3e5d1a-2b4c-4e6f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects explorer.exe spawning processes commonly used to execute LNK payloads
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\control.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection
level: high

Post‑Incident Response

If exploitation is suspected:

1. Immediately isolate the affected machine from the network to prevent lateral movement and further C2 communication.
2. Preserve forensic evidence:
   • Memory capture (RAM)
   • Full disk image or at least:
     • %UserProfile%\Downloads and %UserProfile%\Desktop\ – look for .lnk files
     • %Temp% directory for dropped payloads
     • Windows Event Logs (Security, System, SMBClient, PowerShell)
     • Prefetch files (C:\Windows\Prefetch\)
     • Recent files (Jump Lists)
   • Network traffic capture (if available)
3. Extract and analyze malicious .lnk files:
   • Use tools like LECmd (Eric Zimmerman) or lnk-parse to examine:
     • Target path, icon location, working directory, arguments
     • CLSID values
     • UNC paths pointing to external servers
4. Rotate compromised credentials:
   • Reset passwords for the affected user account.
   • If NTLM hashes were leaked, assume they are cracked/relayed and reset all passwords used on that machine or with the same hash (pass‑the‑hash risk).
5. Block IOCs:
   • Add attacker SMB server IPs/domains to firewall blocklists.
   • Block outbound port 445/TCP if not already done.
6. Perform a full antimalware scan using updated signatures.
   • Check for persistence: Scheduled Tasks, Run keys, Services, WMI subscriptions, Startup folder.
7. Apply the Windows security patch (if not already installed) – February 2026 update + April 2026 update.
8. Assess the scope of compromise:
   • Review network logs for SMB connections to the same malicious server from other hosts.
   • Look for lateral movement using the compromised user’s credentials (Event ID 4624 Logon Type 3 from the victim to others).
9. Rebuild the affected system from a clean image if signs of deep compromise (rootkit, hard‑to‑remove persistence) are found.
10. Document the incident and update security controls (email filtering, SMB egress blocking, user training).

References

• Microsoft Security Response Center (MSRC):
  CVE-2026-21510 | Windows Shell Security Feature Bypass Vulnerability
• NVD – National Vulnerability Database:
  CVE-2026-21510 Detail
• CISA Known Exploited Vulnerabilities Catalog:
  CVE-2026-21510 entry
• Beazley Security Advisory:
  BSL-A1156 – Critical Vulnerabilities in Microsoft Windows (Feb 2026)
• FortiGuard Labs Threat Signal Report:
  APT28 Targeting Ukraine using CVE-2026-21510 (Dec 2025 – Jan 2026)
• Akamai Security Research:
  CVE-2026-21510 – SmartScreen Bypass via Windows Shortcut Files and Incomplete Patch Analysis (CVE-2026-32202)
• The Hacker News:
  Microsoft Confirms Active Exploitation of CVE-2026-21510
• GitHub – EpSiLoNPoInTlnk (PoC Generator):
  https://github.com/EpSiLoNPoInTOrI/EpSiLoNPoInTlnk
• CWE-693 – Protection Mechanism Failure
  https://cwe.mitre.org/data/definitions/693.html