CISA Sounds the Alarm: Actively Exploited Windows and Exchange Vulnerabilities Put Networks at Immediate Risk

Introduction: A Critical Moment for Cyber Defense

Cybersecurity teams across the globe are facing a fresh wave of urgency after a new alert from the Cybersecurity and Infrastructure Security Agency (CISA). Two dangerous vulnerabilities affecting core Microsoft technologies have moved beyond theoretical risk and into active exploitation. This is not a routine advisory. It is a real-world warning backed by ongoing attacks targeting both government systems and private enterprises. Organizations that delay action are no longer just vulnerable, they are exposed.

Summary of the Original

CISA has officially added two major vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog as of April 13, 2026, signaling that these flaws are already being used in active cyberattacks. The affected technologies include the Windows Common Log File System (CLFS) and Microsoft Exchange Server, both deeply embedded in enterprise environments. The agency is urging immediate patching to prevent serious consequences such as data breaches, system compromise, and lateral movement within networks.

The first vulnerability, identified as CVE-2023-36424, affects the Windows CLFS driver. It is categorized as an out-of-bounds read issue, meaning the system may access memory beyond its intended limits. This type of flaw can expose sensitive information or destabilize systems. More critically, it allows attackers with local access to escalate their privileges. Since CLFS is widely used for logging across Windows systems, exploitation could give attackers administrative control, allowing them to disable defenses and expand their reach across