Windows Search URI Handler Vulnerability Exposes NTLMv2 Hashes to Remote Attackers

Gbhackers •Divya • June 3, 2026

Windows systems are once again exposed to NTLM credential leakage through a newly observed abuse of the , URI handler, a vulnerability class closely mirroring the previously patched CVE-2026-33829 in the Snipping Tool. Windows URI Handler Vulnerability Security researchers from Huntress have identified that the Windows URI handler improperly processes user-supplied parameters, allowing attackers to coerce […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Unpatched NTLM Vulnerability in Windows URI Handlers Exposes Credentials A newly identified flaw in Windows URI handlers can leak NTLMv2 hashes to attacker-controlled servers with a single link click. This vulnerability is related to CVE-2026-33829, which was patched in the Windows Snipping Tool on April 14, 2026, but no CVE has been assigned for this variant. The issue arises from the ms-screensketch: URI handler, which does not validate the filePath parameter, allowing NTLM authentication to be triggered and exposing sensitive credentials. Attackers can exploit this flaw without requiring malware, merely by tricking users into clicking a link. The vulnerability affects Windows systems running the Snipping Tool and similar URI handlers. As of now, Microsoft has not provided a fix or acknowledged the new variant. Security professionals are urged to remain vigilant as this could facilitate unauthorized access to networks. 6 sources 49

Extracted Entities

Windows Search URI Handler Vulnerability Exposes NTLMv2 Hashes to Remote Attackers

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)