CISA Adds Actively Exploited Connect Wise and Windows Flaws to KEV
Summary: CISA added two actively exploited flaws to its KEV catalog on Tuesday: CVE-2026-32202 in Microsoft Windows and CVE-2024-1708 in ConnectWise ScreenConnect. Microsoft updated its advisory for CVE-2026-32202 a day earlier to acknowledge active exploitation, and Akamai traced that flaw to an incomplete patch for CVE-2026-21510, which APT28 exploited as a zero-day alongside CVE-2026-21513 against Ukraine and E.U. countries since December 2025.
Bottom line: CVE-2024-1708 has been chained with the CVSS 10.0 authentication bypass CVE-2024-1709 by multiple threat actors, and Microsoft linked exploitation of the flaws to a China-based actor it tracks as Storm-1175 deploying Medusa ransomware. Federal civilian agencies have until May 12, 2026 to apply fixes.