{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "windows-attacked-bugs-apr-2026",
  "url": "https://patchgap.ai/incidents/windows-attacked-bugs-apr-2026/",
  "path": "/incidents/windows-attacked-bugs-apr-2026/",
  "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-apr-2026.json",
  "title": "Windows: a bug fixed in the April 2026 update was used in real attacks",
  "category": "windows",
  "platforms": [
   "windows"
  ],
  "products": [
   "windows"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "CISA lists this as used in real attacks (added 2026-04-28). Microsoft's Security Update Guide marks it as exploited.",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-04-14",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-32202"
  ],
  "summary": "A bug in Windows File Explorer lets a bad file or shared folder fool Windows. It can leak your Windows sign-in details to attackers. Microsoft fixed it in the April 2026 Windows update. Any newer monthly update also includes the fix.",
  "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since April 2026. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
  "action": "Run Windows Update (April 2026 update or newer)",
  "affected": [
   {
    "product": "windows",
    "product_name": "Windows 10 and 11",
    "platform": "windows",
    "affected_versions": "Windows 10 and 11 PCs without the April 2026 security update or a newer one",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Fixed by the April 2026 Windows security update (2026-04-14) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
    "fixed_source_urls": [
     "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202"
    ],
    "check": {
     "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
     "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   }
  ],
  "fix_steps": [
   "Open Start > Settings > Windows Update.",
   "Click Check for updates.",
   "Let the updates download and install.",
   "Restart your computer when it asks."
  ],
  "official_patch_links": [
   {
    "label": "Microsoft: how to update Windows",
    "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   },
   {
    "label": "Microsoft: CVE-2026-32202 details",
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202",
    "title": "Microsoft Security Update Guide: CVE-2026-32202 (April 2026 update)",
    "date": "2026-04-14",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-32202 (added 2026-04-28)",
    "date": "2026-04-28",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32202",
    "title": "NVD: CVE-2026-32202",
    "date": "2026-04-14",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}