Incomplete Windows Patch Opens Door to Zero-Click Attacks

Security researchers at Akamai have discovered that Microsoft's February patch for a Windows SmartScreen vulnerability was incomplete, creating a new zero-click flaw that allows attackers to steal credentials without any user interaction. The original vulnerability, CVE-2026-21510, was exploited by Russia's APT28 hacking group in attacks targeting Ukraine and EU countries, using weaponized shortcut files to bypass Windows security features. Microsoft has since patched the new vulnerability, CVE-2026-32202, in its April updates, but the incident highlights how incomplete patches can inadvertently create new security risks.