What Happened
Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user's NTLMv2 hash to the attacker. Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool's ms-screensketch: URI handler, the newly flagged issue resides in the search: URI handler, per Huntress. CVE-2026-33829 refers to a spoofing vulnerability that could expose
Why It Matters
The report describes an unpatched Windows search: URI handler issue that can cause a victim system to make an outbound SMB connection and leak the user’s NTLMv2 hash to an attacker-controlled server. Huntress says the flaw uses the same NTLM leakage mechanism as the previously patched Snipping Tool URI issue, and Microsoft declined to issue a fix after responsible disclosure. CyberSE.AI analysis: this is primarily a credential/data leakage risk with downstream relay-attack potential, so defenses should focus on restricting outbound SMB, enforcing SMB signing, and reducing NTLM exposure where possible.
CyberSE Analysis
This signal maps to data leakage. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/06/unpatched-windows-search-uri.html