CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV

CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV Ravie LakshmananApr 29, 2026Vulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting ConnectWise ScreenConnect and Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2024-1708 (CVSS score: 8.4) - A path traversal vulnerability in  ConnectWise ScreenConnect that could allow an attacker to execute remote code or directly impact confidential data and critical systems. (Fixed in February 2024) CVE-2026-32202 (CVSS score: 4.3) - A protection mechanism failure vulnerability in  Microsoft Windows Shell that could allow an unauthorized attacker to perform spoofing over a network. (Fixed in April 2026) The addition of CVE-2026-32202 to the KEV catalog comes a day after Microsoft updated its advisory for the flaw to acknowledge it had come under active exploitation. Although Microsoft has not disclosed the nature of the attacks weaponizing the flaw, Akamai said the vulnerability stemmed from an incomplete patch for CVE-2026-21510, which was exploited as a zero-day alongside CVE-2026-21513 by the Russian hacking group APT28 in attacks targeting Ukraine and E.U. countries since December 2025. Attacks exploiting CVE-2024-1708, on the other hand, have been chained with CVE-2024-1709 (CVSS score: 10.0), a critical authentication bypass vulnerability, by multiple threat actors over the years. Earlier this month, Microsoft linked the exploitation of the flaws to a China-based threat actor it tracks as Storm-1175 in attacks deploying Medusa ransomware. It's worth noting that CISA added CVE-2024-1709 to the KEV catalog on February 22, 2024. Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary fixes by May 12, 2026, to secure their networks. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  ConnectWise, cybersecurity, data protection, Microsoft, network security, ransomware, Vulnerability, zero-day Trending News New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails Your MTTD Looks Great. Your Post-Alert Gap Doesn't 108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users The Hidden Security Risks of Shadow AI in Enterprises Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation Why Security Leaders Are Layering Email Defense on Top of Secure Email Gateways Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads OpenAI Launches GPT-5.4-Cyber with Expanded Access for Security Teams Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched Why Threat Intelligence Is the Missing Link in CTEM Prioritization and Validation Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover Load More ▼ Popular Resources Fix Rising Application Security Risks Driven by AI Development Discover Key AI Security Gaps CISOs Face in 2026 Automate Alert Triage and Investigations Across Every Threat How to Identify Risky Browser Extensions in Your Organization