Active SharePoint Spoofing and Legacy Office RCE: CISA Alerts on New KEV Exploits

CISA expanded its Known Exploited Vulnerabilities catalog to include CVE-2026-32201, an improper input-validation flaw in Microsoft SharePoint that can enable network-level spoofing and threaten confidentiality/integrity, and CVE-2009-0238, a legacy Microsoft Excel RCE previously used by Trojan.Mdropper.AC; both are flagged as being weaponized or still exploitable in the wild and federal agencies are required to remediate them by April 28, 2026.