The Cybersecurity and Infrastructure Security Agency added two fresh vulnerabilities to its Known Exploited Vulnerabilities catalog on Monday, confirming that attackers are actively exploiting both a path traversal flaw in ConnectWise ScreenConnect and a protection mechanism bypass in Microsoft Windows. The additions trigger mandatory remediation deadlines for federal civilian agencies and serve as a stark warning for every IT shop: if these flaws are in your environment, treat them as priority zero.

Breaking Down the Two Flaws

CVE-2024-1708: A Backdoor Through ScreenConnect

This path traversal vulnerability affects ConnectWise ScreenConnect versions 23.9.7 and earlier. Path traversal weaknesses let attackers access files and directories outside the software’s intended boundaries. In remote access tools, that often means stealing configuration files, session tokens, or credentials—and in worst‑case scenarios, it can lead to remote code execution.

ConnectWise published a fix in ScreenConnect 23.9.8 and has been urging on‑premises customers to upgrade since the initial disclosure. However, the CISA move signals that many internet‑facing instances remain unpatched and under fire. Because ScreenConnect is the backbone of remote support for thousands of managed service providers, one compromised server can become a launch‑point for ransomware, lateral movement, or supply‑chain attacks against client networks.

Administrators hunting for signs of compromise should look for unexpected user accounts, abnormal session histories, webshells in the ScreenConnect directory, and unusual commands executed on the host. Enforce multi‑factor authentication and rotate all credentials if there’s any doubt.

CVE-2026-32202: Windows Shell Spoofing Bites Again

Microsoft’s April 2026 Patch Tuesday resolved a protection mechanism failure in Windows that CISA now confirms is being exploited in the wild. The flaw, described in public records as a Windows Shell spoofing issue, can allow an unauthorized attacker to spoof content over a network. This is the kind of weakness that fuels phishing campaigns, credential‑theft attacks, and man‑in‑the‑middle scenarios—where a cleverly crafted file or network path looks legitimate but leads to a malicious destination.

While the vulnerability does not carry a “critical” rating in all scoring systems, its exploitation in real attacks speaks volumes. In corporate environments, a spoofed Windows Shell component could trick a privileged user into authenticating to an attacker‑controlled server, handing over credentials without ever raising a malware alert.

The fix arrived in the April 2026 security updates for all supported Windows versions. Windows Update, WSUS, and enterprise patch managers have been delivering the patch for weeks—but machines that missed the cycle are now sitting ducks.

Who Is Affected, and How Bad Could It Get?

Federal agencies have no wiggle room. Under Binding Operational Directive 22‑01, every vulnerability added to the KEV catalog comes with a hard remediation deadline—typically two to three weeks from the listing date. For the April 28 additions, that puts the due date around mid‑May 2026. Failure to meet it means non‑compliance with a federal mandate.

Managed service providers and IT teams that host ScreenConnect face the greatest risk from CVE-2024-1708. A compromised remote‑management server hands attackers the keys to every endpoint it supports. Check your version number immediately. Self‑hosted instances that haven’t moved to 23.9.8 or later must be upgraded without delay. Cloud‑hosted ScreenConnect instances are generally patched by ConnectWise, but it’s worth confirming with the vendor and still reviewing access logs for anything suspicious.

Windows administrators in any organization need to confirm that the April 2026 cumulative update is installed on every endpoint and server. This includes workstations, RDS hosts, and file servers that process untrusted content. The spoofing flaw doesn’t require local access; an attacker just needs a user to interact with a malicious file or network path—classic social‑engineering territory.

Home users and small offices are unlikely to be running ScreenConnect, but they are wildcards for the Windows vulnerability. If automatic updates are paused or delayed, a home PC still running the March 2026 patch level is vulnerable. Head to Settings > Windows Update, click “Check for updates,” and install everything offered. Don’t ignore optional updates that may carry the same fix.

How We Got Here: CISA’s KEV Catalog and the Urgency of Exploitation

The Known Exploited Vulnerabilities catalog isn’t a general vulnerability database. It was born from BOD 22‑01, issued in November 2021, with a clear mission: stop telling agencies about every theoretical risk and start flagging the ones that are actually lighting up intrusion‑detection systems. Any CVE that makes the list has evidence of active exploitation and meets a threshold of meaningful risk to the federal enterprise.

Since its launch, the KEV catalog has grown into a de facto priority list for the private sector as well. Cyber insurers reference it. Red teams build scenarios around it. Managed detection and response providers tune their alerts to it. When CISA adds a vulnerability, security teams across the globe treat it as a five‑alarm fire—because in nearly every case, attackers are already inside someone’s network using it.

April 2026 has been a busy month. The ScreenConnect and Windows additions follow a string of other KEV updates, underscoring a trend: attackers are shortening the time between a patch’s release and its exploitation in the wild. In some cases, proof‑of‑concept code appears within hours. That makes the gap between Patch Tuesday and an organization’s actual deployment a critical window of exposure.

Your Move‑by‑Move Remediation Guide

For ScreenConnect (CVE-2024-1708)

  1. Inventory every ScreenConnect instance. This means MSP‑managed servers, old test boxes, and shadow‑IT deployments. Use network scans and asset management tools to find them.
  2. Check the exact version. Versions 23.9.7 and earlier are vulnerable. Upgrade to 23.9.8 or later—or better, to the latest release. Download the update directly from ConnectWise.
  3. Assume breach and hunt for IoCs. Review administrative accounts for any you don’t recognize. Audit session logs for connections from unexpected IP addresses or at odd hours. Scan the ScreenConnect installation directory for webshells (e.g., .asp, .aspx, .php files that shouldn’t be there). Look for unusual processes launched by the ScreenConnect service.
  4. Rotate credentials and harden access. Force password resets for all ScreenConnect users. Enable multi‑factor authentication if it isn’t already mandatory. Restrict web interface access to trusted IP ranges via firewall rules.
  5. If exploitation is confirmed, ring the bell. Contact your incident response team or a third‑party IR firm. Preserve forensic evidence before cleansing systems. Notify affected clients if you are an MSP.

For Windows (CVE-2026-32202)

  1. Validate patch deployment. In your patch management console, check for computers that failed the April 2026 cumulative update. For Windows 10/11 and Server 2016/2019/2022, the update KB number varies by version—confirm with Microsoft’s Security Update Guide. Any machine still running the March 2026 patch level is exposed.
  2. Test and deploy rapidly. If you haven’t yet approved the April updates, fast‑track them. Focus on workstations used by executives, finance, HR, and IT—privileged users are prime targets for spoofing attacks. Servers that host file shares or act as domain controllers should be patched immediately.
  3. Monitor for exploitation attempts. Enable logging of SMB and NTLM authentication events. Look for outbound connections to unusual hostnames or IP addresses on ports 139/445 after a user double‑clicks a file or navigates in File Explorer. A sudden spike in failed logons from the same user account could indicate credential harvesting.
  4. Users can’t patch fast enough? Reduce risk. Block outbound SMB to the internet at the firewall. Disable NTLM where possible and enforce Kerberos. Use AppLocker or WDAC to restrict what executables can run from user‑writable directories. Send a company‑wide reminder not to open unsolicited .url, .lnk, or .zip files—common vectors for shell spoofing.

What to Watch Next

CISA will continue adding vulnerabilities that meet its exploitation criteria. With the pace of KEV updates quickening, organizations should integrate the catalog directly into their vulnerability management dashboards—treating each new addition as a breaking‑news event rather than a routine alert. The two flaws added April 28 illustrate a familiar pattern: one is a patch that has existed for months (ScreenConnect) while the other is a fresh Patch Tuesday fix already under fire (Windows). Timely patching remains the single most effective defense, but it only works when organizations close the gap between release and deployment.