CISA orders feds to patch Windows flaw exploited as zero-day

CISA has ordered U.S. federal agencies to urgently patch a Windows zero-day (CVE-2026-32202) — described as a zero-click credential-theft vector left after an incomplete fix for CVE-2026-21510 — following active exploitation reports; Akamai and CERT-UA tied exploitation activity to APT28 and urged immediate mitigation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a May 12 remediation deadline under BOD 22-01.