Microsoft confirmed active exploitation of CVE-2026-32202, a high-severity Windows Shell spoofing vulnerability patched in May 2026. The flaw allows attackers to manipulate shell-level trust or visual presentation to deceive users and potentially bypass origin checks, with reported linkage to APT28, a Russian state-sponsored threat actor. Organizations running unpatched Windows systems face elevated risk of credential theft, malware delivery, or deeper compromise; the CVSS score of 7.5 understates operational urgency given confirmed in-the-wild exploitation.