CVE-2026-32202: CISA KEV Listing Forces CISOs to Act

7 min read

CVE-2026-32202 has been listed in the CISA Known Exploited Vulnerabilities (KEV) since April 28, 2026. This vulnerability in the Windows Kernel Subsystem is actively exploited by APT28. The context makes this case particularly relevant: CVE-2026-32202 is a follow-up exploit to CVE-2026-21510, a vulnerability addressed by a Microsoft patch in March 2026. APT28 has demonstrated that the patch was incomplete. For DACH-CISOs, this means a structural reevaluation of their patch validation processes.

Key Takeaways

CVE-2026-32202 in CISA KEV since 04/28/2026. CVSS 8.8, privilege escalation in Windows Kernel Memory Manager. Active APT28 exploitation confirmed. No public exploit code, but APT28 TTPs known.
Patch bypass pattern is the issue. Microsoft patched CVE-2026-21510 in March 2026. CVE-2026-32202 is a bypass of the same patch. Systems that were only patched for CVE-2026-21510 remain vulnerable.
APT28 context increases criticality. APT28 (Fancy Bear, GRU Unit 26165) is a sophisticated actor with a focus on NATO targets, governments, and critical infrastructure. DACH operators in energy, transport, and telecommunications are preferred targets.
Immediate action required. CISA mandates for US federal agencies are set at 3 weeks. For DACH operators, NIS2 requires a 72-hour patching window for critical systems upon known exploitation.

CVE-2026-32202 in Detail: Technical Context

What is CVE-2026-32202? CVE-2026-32202 is a privilege escalation vulnerability in the Windows Kernel Memory Manager. A local attacker with low privileges can gain SYSTEM rights through faulty handle validation. The CVSS score of 8.8 (High) reflects the complete system compromise in the event of a successful attack. The prerequisite is local code execution, which is typically achieved through a second vulnerability or phishing for initial access.

The critical context: In March 2026, Microsoft patched CVE-2026-21510, a similar vulnerability in the same subsystem. CVE-2026-32202 addresses a codepath that the initial patch did not cover. This is not a failure of the patch itself but a structural challenge: Complex subsystems with many codepaths can produce partial patches that close one attack path but leave adjacent ones open.

CVE-2026-32202 Overview

8.8

CVSS Score (High)

LPE

Local Privilege Escalation

APT28

actively exploited by GRU

APT28: Why the Actor Changes the Game

APT28 is not an opportunistic attacker. GRU Unit 26165 operates with clear political and strategic goals: intelligence gathering in NATO countries, destabilization of government systems, and targeted attacks on critical infrastructure. The group is responsible for the SolarWinds supply chain attack (2020), the attack on the German Bundestag (2015), and several attacks on NATO members.

When APT28 exploits a vulnerability, the risk assessment for specific target groups fundamentally changes. CVE-2026-32202 may be less critical for an industrial operation in Bavaria than for a critical infrastructure operator in Germany. However: APT28 uses initial-access brokers and compromised supply chain positions. If you are a supplier to a critical infrastructure operator, you can still serve as an entry point even if you are not a direct target.

Immediate Actions for Security Teams: Step by Step

Verify Patch Status for CVE-2026-32202. Check Microsoft KB number (April 2026 Cumulative Update). Systems that have the CVE-2026-21510 patch but not the April 2026 CU remain exposed. Use WSUS/SCCM queries to check patch level, not just CVE status.
Exposure Analysis: Which Systems are Relevant? LPE vulnerabilities require local execution as a prerequisite. Risk increase: VDI environments with many users, terminal servers, shared jump hosts. Review isolation strategies for high-privilege systems.
Load APT28 IOCs into SIEM. CISA and NSA have published IOC sets for APT28 campaigns (AA24-249A and related documents). If not already done: Import current IOC sets and check against historical log data from the last 90 days.
Evaluate NIS2 Reporting Obligations. For critical infrastructure operators: Active exploitation of a KEV vulnerability by a state actor can be classified as a “significant incident” under NIS2 if your own systems were affected. Legal assessment within 24 hours.
Anchor Patch Bypass Pattern in Vulnerability Management. CVE-2026-32202 is not an isolated case. Patch validation processes must include “follow-up CVE in the same subsystem” as a separate category and actively check during the next patching cycle.

Implications for Vulnerability Management in DACH Companies

CVE-2026-32202 exemplifies a structural problem in vulnerability management: the patch bypass cycle. Security teams that base their risk assessment on “patched CVE status” have a blind spot for follow-up CVEs in the same subsystem. The response to this incident should not just be “roll out this patch” but trigger a process review.

Three measures improve the detection rate for future patch bypass patterns: First, Windows subsystem tracking in the vulnerability management tool. If CVE-2026-21510 and CVE-2026-32202 affect the same kernel component, the system should automatically link them. Second, vendor advisory monitoring for Microsoft patches with “partial fix” or “defense in depth” notation. Microsoft sometimes indicates such cases in the MSRC advisory texts. Third, 30-day follow-up after high/critical kernel patches: explicitly search for follow-up CVEs in the same area.

For the technical MSRC advisory on CVE-2026-32202, see msrc.microsoft.com. For APT28 TTPs, refer to the MITRE ATT&CK profile at attack.mitre.org/groups/G0007/. The CISA KEV catalog is available at cisa.gov/known-exploited-vulnerabilities-catalog.

Sources: CISA KEV Database (28.04.2026), Microsoft Security Response Center MSRC CVE-2026-32202, NSA/CISA Advisory AA24-249A (APT28 TTPs), BSI Situation Report 2025.

Frequently Asked Questions

Is CVE-2026-32202 critical without the APT28 context?

Yes. With a CVSS score of 8.8 and the ability to bypass patches, this vulnerability is critical regardless of the attacker. Any Windows system that has been patched for CVE-2026-21510 but not for the April 2026 cumulative update (CU) is at risk. While APT28 exploitation increases urgency for critical infrastructure environments, it does not change the fundamental patching priority for all Windows environments.

What does “CISA KEV” mean for German companies specifically?

CISA KEV is a US government mandate for federal agencies, but it has de facto global implications. Inclusion in the CISA KEV list means active exploitation has been confirmed by CISA, not just a theoretical risk. For German companies, KEV serves as a high-quality signal for prioritizing patches. BSI-CERT often references CISA KEV as the primary source for confirmed active exploitation.

How can you tell if APT28 has already been in the network?

APT28 employs documented TTPs (Tactics, Techniques, Procedures) from the MITRE ATT&CK framework (Group G0007). Key indicators include lateral movement via SMB and WMI, credential harvesting using Mimikatz-like tools, and data exfiltration over HTTPS to known C2 infrastructure. The CISA Advisory AA24-249A provides current network IOCs and host-based indicators. Recommendation: Use SIEM queries against these IOCs with a 90-day lookback period.

What is the difference between local and remotely exploitable privilege escalation?

CVE-2026-32202 is a local privilege escalation (LPE) vulnerability, which requires existing code execution on the target system. This makes it less immediately impactful than remote code execution (RCE), but in combined attack chains, LPE is often the second step after initial access (e.g., phishing + malware execution). APT28 attacks typically use RCE for initial access and LPE for persistence and lateral movement.

What are patch bypass vulnerabilities and why do they occur?

A patch bypass vulnerability arises when a fix closes one attack path but leaves alternative execution paths open in the same code area. This is particularly common in complex kernel subsystems with many call paths. Microsoft has documented several such bypass series in the past five years (e.g., Print Spooler class 2021). For security teams, this means increased vigilance for follow-up CVEs in the same component for 30 to 60 days after each kernel subsystem patch.