On June 2, 2026, security researchers at Huntress published findings about an unpatched Windows vulnerability that lets attackers steal a user's credential hash with a single link click. No malware. No file download. No warning dialog before it happens. One click — and the credentials are gone. Microsoft reviewed it and decided not to fix it.
The vulnerability lives in the Windows search: URI handler — a built-in Windows feature that allows applications to open Windows Search. When a specially crafted search: URI containing a crumb=location: parameter pointing to an attacker-controlled server is activated, Windows automatically attempts to authenticate to that server using NTLM.
This exposes the user's Net-NTLMv2 hash to the attacker's server within seconds. The victim sees an error message — "Windows cannot access the specified device, path, or file" — but by the time that error appears, the credential leak has already occurred. The attack works via a link click in Edge. No file download, no execution prompt, no security warning.
Tested on Windows 11 with Windows Defender on default settings — zero alerts. Standard user account, no admin rights required. The credential hash leaves the machine within one second of the link being clicked, before the user sees any error.
This vulnerability is technically identical to CVE-2026-33829, which Microsoft patched in the Windows Snipping Tool on April 14, 2026. The mechanism is the same. The severity is the same. The outcome is the same. The only difference is which Windows component is affected.
| Aspect | CVE-2026-33829 (Snipping Tool) | This Bug (search: handler) |
|---|---|---|
| Class | NTLM leakage via URI handler | NTLM leakage via URI handler |
| CVSS Score | 4.3 (Moderate) | 4.3 (Moderate, per researcher's calculation) |
| Admin rights required? | No | No |
| Malware required? | No | No |
| Works via link click? | Yes | Yes |
| Windows Defender alerts? | No | No |
| Patched by Microsoft? | Yes — April 14, 2026 | No — Below servicing bar |
"Typically, only Important and Critical severity cases meet our bar for servicing... Unfortunately, there are different factors that come into play which sometimes causes exception to our standard processes." In other words: the Snipping Tool vulnerability was the exception that got patched. The shell-level vulnerability with identical impact did not. Whether a Moderate-severity URI handler NTLM leakage gets fixed is, per Microsoft's own description, exception-driven.
NTLM (NT LAN Manager) is a legacy Windows authentication protocol still widely used in corporate environments. When Windows connects to a server via a UNC path, it sends a challenge-response called a Net-NTLMv2 hash. This is not the user's raw password, but it is a valuable authentication artifact:
Block TCP/445 and TCP/139 outbound on endpoints that do not need to reach external file servers. This is the single highest-value mitigation for this vulnerability and the broader class of NTLM leakage attacks. Most corporate endpoints have no legitimate need to initiate outbound SMB connections to the internet. Apply this via host-based firewall rules or network perimeter controls.
SMB signing prevents captured hashes from being used in relay attacks against internal services. Enable via Group Policy: Microsoft network client: Digitally sign communications (always) set to Enabled. This does not prevent the hash from being captured, but it significantly limits what an attacker can do with it.
Neither the search: nor search-ms: URI schemes belong in legitimate business email or web proxy traffic. If your email gateway or web proxy logs these schemes, treat them as suspicious. If you already alert on search-ms:, add search: to the same detection rule now.
Set RestrictSendingNTLMTraffic to 2 (Deny All) via Group Policy. This blocks the class of vulnerabilities entirely, but will break applications that rely on NTLM authentication. Audit your environment for NTLM usage thoroughly before applying this setting.
This vulnerability exposes a structural gap in CVE-based patch management. If your patch program defines "patched" as "has a Microsoft CVE and a fix," you have blind spots. Microsoft does not always assign CVEs to vulnerabilities it chooses not to fix. An organization that patched CVE-2026-33829 in April has zero visibility into this unpatched variant with identical security impact.
Effective patch management requires threat-informed risk assessment — understanding the actual exploitability and business impact of vulnerabilities, not just counting CVE IDs. Defense-in-depth controls like outbound SMB blocking provide protection for the entire class of NTLM leakage vulnerabilities, regardless of whether any specific instance has a CVE assigned to it.