US Cyber Agency Orders Emergency Patch for Windows Flaw

The U. S.

Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to patch a Windows vulnerability, CVE-2026-32202, actively exploited in zero-day attacks. This directive requires Federal Civilian Executive Branch (FCEB) agencies to implement the patch by May 12.

The vulnerability is a zero-click NTLM hash leak, stemming from an incomplete patch for a prior remote code execution flaw (CVE-2026-21510). Exploitation allows attackers to view sensitive information and conduct pass-the-hash attacks, leading to lateral movement and data exfiltration.

While the previous flaw (CVE-2026-21510) was exploited by a state-sponsored cyberespionage group against Ukraine and EU countries, there is no confirmed link between this group and the current CVE-2026-32202 exploitation. CISA has emphasized that this type of vulnerability poses significant risks to federal enterprises.

All organizations are urged to prioritize patching this vulnerability to mitigate potential security risks. This action aligns with Binding Operational Directive (BOD) 22-01, which governs the remediation of known exploited vulnerabilities within federal systems.