An unpatched vulnerability in Windows’ ‘search:’ URI handler can be exploited to leak a user’s NTLMv2 credential hash to an attacker, similar to a recently disclosed flaw in the Windows Snipping Tool (CVE-2026-33829). NTLMv2 hashes can be cracked offline or used in relay attacks to authenticate as the victim. The vulnerability remains unpatched, making it an active risk for any Windows environment, including cloud-connected hybrid setups.

Architect’s Take: Block or restrict outbound SMB traffic (TCP 445) at the network perimeter and enforce NTLM restrictions via Group Policy or Azure AD Conditional Access to reduce relay attack exposure. Additionally, consider deploying Defender for Endpoint or equivalent EDR rules to flag suspicious search: URI handler invocations until a patch is available.

Original advisory: Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes