Windows Search URI Handler NTLMv2 Hash Leak (CVE-2026-33829) | MSSP Advisory

Risk Assessment

Huntress researcher Andrew Schwartz disclosed an unpatched vulnerability in the Windows search: URI handler that leaks NTLMv2 hashes to an attacker-controlled SMB server. The attack requires only a single user click on a crafted link delivered via email or web page, after which Windows silently authenticates outbound to an attacker SMB share and surrenders the Net-NTLMv2 hash. Microsoft reviewed the disclosure and declined to patch it, rating it below their servicing threshold, leaving every unmitigated Windows endpoint exposed indefinitely.

Your RMM agents, PSA connectors, and technician workstations all run on Windows, and a single phishing email to one of your own staff could hand an attacker a crackable or relayable hash with access to everything that technician touches across your client base. On the client side, you manage environments where end users click links in email constantly, and if a client gets compromised through a vector you knew about and said nothing, that is a contract conversation you do not want to have.