CISA Sounds the Alarm: State-Sponsored Hackers Weaponize New Windows and ScreenConnect Flaws

CISA added two actively exploited, high-risk vulnerabilities to its KEV catalog: CVE-2024-1708 (ConnectWise ScreenConnect path traversal) exploited by North Korea’s Kimsuky to deploy the polymorphic ToddlerShark malware, and CVE-2026-32202 (Windows Shell protection failure) abused by Russia’s APT28—often chained with MSHTML—prompting urgent patching/upgrades and a federal remediation directive.