Pierluigi Paganini
April 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Windows Shell and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
CVE-2024-02-21 is a path traversal vulnerability affecting ConnectWise ScreenConnect versions 23.9.7 and earlier. The issue stems from improper restriction of file paths, allowing attackers to access files and directories outside the intended scope.
By exploiting this flaw, an attacker could manipulate file paths to reach sensitive areas of the system. In certain scenarios, this may lead to remote code execution or unauthorized access to confidential data and critical resources, posing a serious risk to affected environments.
The second flaw added to the catalog is a Windows Shell Spoofing vulnerability tracked as CVE-2026-32202. The flaw allows attackers to spoof content over a network due to a failure in built-in protection mechanisms.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by May 12, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
