【Vulnerability Alert】CISA added 4 known exploited vulnerabilities to the KEV Catalog (2026/04/27-2026/05/03)

publish date : 2026-05-08 update date : 2026-05-15

Source: Ministry of education information & communication security contingency platform

"" "" ""


Publication Number	TACERT-ANA-2026050605055656	Publication Time	2026-05-06 17:25:57
Incident Type	ANA-Vulnerability Alert	Discovery Time	2026-05-06 17:25:57
Impact Level	Low
[Subject] 【Vulnerability Alert】CISA added 4 known exploited vulnerabilities to the KEV Catalog (2026/04/27-2026/05/03)
[Content] Forwarded from TWCERTCC Information Security Message Alert TWCERTCC-200-202605-00000003 【CVE-2024-1708】ConnectWise ScreenConnect Path Traversal Vulnerability (CVSS v3.1: 8.4) 【Whether exploited by ransomware: Unknown】 ConnectWise ScreenConnect contains a path traversal vulnerability, which may allow attackers to execute remote code, or directly affect confidential data and critical systems. 【CVE-2026-32202】Microsoft Windows Protection Mechanism Failure Vulnerability (CVSS v3.1: 4.3) 【Whether exploited by ransomware: Unknown】 Microsoft Windows Shell contains a protection mechanism failure vulnerability, allowing unauthorized attackers to conduct spoofing attacks over the network. 【CVE-2026-41940】WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability (CVSS v3.1: 9.8) 【Whether exploited by ransomware: Unknown】 WebPros’ cPanel and WHM (WebHost Manager), as well as WP2 (WordPress Squared), contain an authentication bypass vulnerability in the login process, allowing unauthenticated remote attackers to access the control panel. 【CVE-2026-31431】Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability (CVSS v3.1: 7.8) 【Whether exploited by ransomware: Unknown】 Linux Kernel contains an Incorrect Resource Transfer Between Spheres vulnerability, which may lead to privilege escalation. (Information Sharing Level: WHITE (Information content can be publicly disclosed)
[Affected Platform] 【CVE-2024-1708】Please refer to the affected versions listed by the official source https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 【CVE-2026-32202】Please refer to the affected versions listed by the official source https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 【CVE-2026-41940】Please refer to the affected versions listed by the official source https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 【CVE-2026-31431】Please refer to the affected versions listed by the official source https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/
[Recommended Actions] 【CVE-2024-1708】The official source has released a fix update for the vulnerability. Please update to the relevant version https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 【CVE-2026-32202】The official source has released a fix update for the vulnerability. Please update to the relevant version https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 【CVE-2026-41940】The official source has released a fix update for the vulnerability. Please update to the relevant version https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 【CVE-2026-31431】The official source has released a fix update for the vulnerability. Please update to the relevant version https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/
[Reference]

(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw

Organizer: Computer Center

Click Num:

Share