🛡️ SecOps

CISA KEV Additions: Windows Shell Spoofing CVE-2026-32202 and Cisco SD-WAN Sensitive File Exposure CVE-2026-20133

CISA's late-April Known Exploited Vulnerabilities additions include a Windows Shell protection mechanism failure under active exploitation and a Cisco Catalyst SD-WAN Manager flaw allowing unauthenticated access to sensitive OS files. Federal agencies face a May 12 remediation deadline for CVE-2026-32202; enterprise organisations should treat both additions as confirmation of active threat actor interest and patch accordingly.

4 min read
#cisa-kev#windows#cisco-sd-wan#actively-exploited#patch-management#cve-2026-32202#cve-2026-20133

CISA’s Known Exploited Vulnerabilities catalogue received two notable additions in the closing days of April 2026, confirming active threat actor exploitation of a Windows Shell flaw and a Cisco Catalyst SD-WAN Manager file disclosure vulnerability. Both carry Federal Civilian Executive Branch (FCEB) agency remediation deadlines and provide a signal for enterprise security teams about current attacker targeting priorities.

CVE-2026-32202 — Windows Shell Protection Mechanism Failure

CVSS base score: 4.3 (Medium) — but KEV addition confirms active exploitation regardless of score
FCEB deadline: May 12, 2026
Patch: Available in April 2026 Patch Tuesday cumulative update

CVE-2026-32202 is a protection mechanism failure in the Windows Shell component — the system responsible for rendering the Windows desktop environment, managing file associations, and processing shell protocol handlers. The specific flaw allows a crafted shortcut file (.lnk) or shell protocol URI to bypass Mark of the Web (MotW) security enforcement, causing Windows to open or execute files downloaded from the internet without the SmartScreen / Protected View warnings that users rely on as a last-line defence against malicious content.

The relatively low CVSS score reflects that exploitation requires user interaction — a user must open or process a crafted file. However, this is precisely the interaction pattern exploited in spear-phishing campaigns, and CISA’s active exploitation confirmation indicates threat actors are using CVE-2026-32202 to bypass MotW controls in the wild. Historical Windows Shell MotW bypass vulnerabilities (CVE-2022-41091, CVE-2023-36025) were leveraged by ransomware groups including Qakbot and Magniber to deliver payloads without user security prompts.

Affected systems: All Windows 10/11 versions and Windows Server 2019/2022/2025 prior to April 2026 cumulative update. Enterprise environments with update deferrals in place should treat this as a priority pull-forward given the KEV status.

CVE-2026-20133 — Cisco Catalyst SD-WAN Manager Sensitive File Exposure

CVSS base score: 7.5 (High)
FCEB deadline: May 12, 2026 (per CISA’s standard 21-day window from April 21 KEV addition date)
Patch: Fixed in Cisco Catalyst SD-WAN Manager 20.15.1 and later

CVE-2026-20133 exists in the vshell subsystem of Cisco Catalyst SD-WAN Manager (formerly vManage), the centralised management and orchestration platform for Cisco SD-WAN deployments. Insufficient filesystem restrictions in the vshell API allow an unauthenticated remote attacker to read sensitive files from the SD-WAN Manager host operating system — including configuration files, authentication tokens, and potentially private keys used for WAN edge certificate authentication.

This vulnerability is distinct from the Cisco SD-WAN vulnerabilities previously covered under CISA Emergency Directive ED 26-03 (CVE-2026-20122, CVE-2026-20127, CVE-2026-20128). CVE-2026-20133 affects the SD-WAN Manager management plane specifically, with potential for extracting material that could enable subsequent privileged access to the SD-WAN overlay fabric.

In enterprise SD-WAN deployments, the Catalyst SD-WAN Manager holds WAN edge certificates, network topology, routing policy, segmentation configuration, and potentially IPsec/TLS pre-shared keys for branch-to-branch tunnels. File exposure in this context can provide an attacker with the reconnaissance material needed to compromise the WAN fabric itself.

Affected versions: Cisco Catalyst SD-WAN Manager releases prior to 20.15.1; also affects SD-WAN vManage releases in the 20.12.x and 20.13.x branches without specific patches. Consult Cisco’s security advisory for the full version matrix.

For CVE-2026-32202 (Windows Shell):

  • Apply April 2026 cumulative update — the fix is included in the standard monthly rollup; organisations with deferred update policies should advance the pull-forward for this release given KEV status.
  • Review email gateway filtering for .lnk and other shell-protocol file types — blocking attachment delivery of file types associated with MotW bypass reduces the phishing delivery surface.
  • Enable Attack Surface Reduction rules — specifically the ASR rule Block all Office applications from creating child processes and Block execution of potentially obfuscated scripts, which reduce the utility of MotW bypass payloads.

For CVE-2026-20133 (Cisco SD-WAN Manager):

  • Upgrade to SD-WAN Manager 20.15.1 or apply the specific SMU patch for your running branch — consult Cisco PSIRT advisory for branch-specific patch guidance.
  • Restrict SD-WAN Manager management plane access — confirm that the SD-WAN Manager vshell API is not accessible from untrusted network segments; management plane access should be restricted to dedicated management VLANs or via a jump host.
  • Rotate WAN edge certificates and assess key exposure — if SD-WAN Manager was internet-accessible prior to patching, treat certificates and any pre-shared keys managed through the platform as potentially compromised.

Share this article