Security researchers have disclosed an unpatched Windows Search URI issue that could allow attackers to steal a user’s NTLMv2 hash. According to The Hacker News, the issue affects the `search:` URI handler and can be abused through a crafted link that forces the victim’s machine to connect to an attacker-controlled SMB server. If the user approves opening the link, Windows may attempt NTLM authentication and expose the Net-NTLMv2 hash. 

Why This Matters 

This is not a traditional malware download or ransomware payload. The danger is more subtle. An attacker can use a crafted link in a web page, email, or message to trigger authentication to a remote SMB share. Once the NTLMv2 hash is captured, it may be used for relay attacks or offline cracking attempts, depending on the environment and password strength. 

The issue is similar in impact to a previously patched Windows Snipping Tool URI handler flaw, CVE-2026-33829, where a crafted URI could also cause Windows to connect to an attacker-controlled SMB server and leak NTLMv2 credentials. In this newer case, researchers found that the same kind of leakage can be triggered using the Windows Search URI handler with `crumb=location:` pointing to a UNC path. ([The Hacker News][1])

The Bigger Security Concern 

NTLM has been a recurring weak point in Windows environments for years. It continues to create risk because captured hashes can sometimes be relayed to internal services, especially where SMB signing and stronger authentication controls are not enforced. So, naturally, the ancient authentication ghost is still haunting modern networks, because apparently retirement is optional in Windows security.

This kind of vulnerability is particularly dangerous in corporate networks where users are logged in with domain credentials. A simple click can create an opportunity for credential exposure, and attackers may use that exposure to move deeper into the network.

What Organizations Should Do 

Organizations should block outbound SMB traffic to the internet, especially TCP ports 445 and 139, from endpoints that do not need it. This is one of the most practical mitigations because workstations generally should not be authenticating to random SMB servers on the internet. The Hacker News report also recommends blocking outbound SMB, enforcing SMB signing, and disabling NTLM where possible. ([The Hacker News][1])

Security teams should also enforce SMB signing to reduce the risk of relay attacks, review where NTLM is still enabled, and move toward disabling NTLM where business applications allow it. Email and web filtering should detect suspicious `search:` URI links, UNC paths, and links designed to trigger external authentication.

Endpoint teams should monitor for unusual SMB connections from user workstations to unknown external IPs. Authentication logs, proxy logs, EDR telemetry, and firewall logs can help identify suspicious outbound SMB attempts. Because if an endpoint suddenly wants to authenticate to a mystery SMB server on the internet, it is probably not trying to make friends.

Final Comment 

The Windows Search URI issue shows that credential theft does not always require malware execution. Sometimes attackers only need to abuse trusted Windows features and convince a user to click a crafted link.

The lesson is clear: restrict outbound SMB, enforce SMB signing, reduce or disable NTLM usage, and monitor unexpected authentication attempts. Organizations should not wait for a patch before reducing exposure. When a built-in URI handler can leak credentials, the safest approach is to assume that identity and network controls must carry the defense, not user caution alone.


Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user's NTLMv2 hash to the attacker. Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool's ms-screensketch: URI handler, the newly flagged issue resides in the search: URI handler, per Huntress. CVE-2026-33829 refers to a spoofing vulnerability that could expose

Source: Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes via The Hacker News — published 03 Jun 2026.