CISA added four zero-days to its Known Exploited Vulnerabilities catalogue on July 14, all confirmed exploited in the wild: two SonicWall SMA1000 flaws and two Microsoft vulnerabilities from the July Patch Tuesday release. The federal remediation deadline for all four is July 17 — three days from confirmation. For private-sector organisations, the CISA deadline is not legally binding, but the exploitation context makes it operationally relevant regardless.
The SonicWall chain: SSRF meets code injection
The two SonicWall vulnerabilities are designed to work together. Attackers have been exploiting them in combination in zero-day incidents confirmed by SonicWall.
CVE-2026-15409 — CVSS 10.0. A server-side request forgery vulnerability in the SMA1000 WorkPlace web interface. The flaw requires no authentication, no user interaction, and the changed scope indicator (S:C) in the CVSS vector reflects that a successful exploit lets an attacker coerce the appliance into making arbitrary requests to internal network resources — resources that sit behind the appliance’s trust boundary. Network proxying, internal API polling, and reconnaissance against backend systems are all in scope. CVSS 10.0 reflects the combination of unauthenticated access, no interaction required, and the network pivot capability. Advisory reference: SNWLID-2026-0008.
CVE-2026-15410 — CVSS 7.2. A code injection vulnerability in the SMA1000 Appliance Management Console (AMC), exploitable by an authenticated administrator-level account. Successful exploitation allows execution of arbitrary operating system commands. In isolation, a post-auth flaw requiring admin credentials is a narrower risk. In combination with CVE-2026-15409, it is not. The SSRF gives an attacker network reach to the AMC interface; the code injection converts that reach into OS-level command execution on the appliance.
Affected devices are the SonicWall SMA6210, SMA7210, and SMA8200v. These are enterprise remote access appliances — they sit on the network perimeter, are externally accessible by design, and carry session credentials for the VPN users that traverse them. An appliance under attacker control is a privileged position: it can intercept authentication material, manipulate user sessions, and serve as a stable foothold into the target network.
The Microsoft additions
The same July 14 KEV batch includes two Microsoft vulnerabilities added alongside the SonicWall flaws.
CVE-2026-56164 is a missing authentication flaw in Microsoft SharePoint with a CVSS base score of 9.8, carrying a July 17 CISA deadline. Missing authentication at CVSS 9.8 means an unauthenticated attacker can reach functionality that should require credentials — in a SharePoint context, that typically translates to data access, privilege escalation paths, or a stepping stone into broader Microsoft 365 and Entra ID environments.
CVE-2026-56155 affects Active Directory Federation Services (ADFS), rated CVSS 7.8, with an extended CISA deadline of July 28. The flaw is a local privilege escalation with a local access requirement (AV:L), but post-exploitation context matters here. An attacker who has already established a foothold on a system with ADFS client connectivity can escalate to higher privileges and pursue Golden SAML attack paths — forging SAML tokens to authenticate as any user across federated identity boundaries, including Azure and third-party SaaS services. ADFS remains in production at a significant portion of enterprise organisations that have not completed migration to Entra ID.
Why the deadline pressure is real
All four vulnerabilities are confirmed exploited in zero-day attacks. In the SonicWall case, SonicWall’s own advisory stated they were investigating multiple incidents before patches were available. The July 17 deadline gives organisations roughly 72 hours from the KEV announcement to achieve remediation.
The VPN appliance attack surface is high-value for threat actors across the spectrum: ransomware operators need initial access, and nation-state actors require persistent, low-noise footholds. SonicWall appliances have been targeted repeatedly by both categories of actor in 2025 and 2026. The combination of a CVSS 10.0 SSRF with a code injection that converts it to RCE is an unusually clean exploitation chain.
Recommended actions
SonicWall SMA1000 (CVE-2026-15409 and CVE-2026-15410):
- Apply SonicWall’s security patches for SNWLID-2026-0008 immediately. Treat the July 17 deadline as a hard target regardless of sector.
- If patching cannot be completed by July 17: restrict access to the WorkPlace interface at the network perimeter. The AMC interface should not be externally accessible under any normal operational configuration — verify this is enforced.
- Review SMA1000 access logs for anomalous internal requests, unexpected admin-panel authentication, or unusual command execution patterns. If SSRF exploitation was successful before discovery, there may be reconnaissance activity in logs from prior days.
- Treat credential material that transited the appliance as potentially compromised during any window of unpatched exposure. Reset VPN user credentials if you cannot confirm the appliance was not reached during the zero-day period.
Microsoft SharePoint (CVE-2026-56164):
- Apply July 2026 Patch Tuesday updates. For organisations where SharePoint is externally accessible, treat this with the same urgency as the SonicWall advisory.
- Audit SharePoint access logs for unauthenticated access attempts and privilege escalation signals from the past two weeks.
Active Directory Federation Services (CVE-2026-56155):
- Apply July Patch Tuesday updates. The local access requirement means immediate risk is concentrated on systems with existing compromise.
- For organisations still running ADFS: review federation trust configurations, audit SAML token issuance logs, and verify that ADFS servers are not accessible from untrusted segments.
- The Golden SAML threat path means remediation of this flaw should be accompanied by a review of federated identity trust relationships — a compromised ADFS server can issue tokens that persist after patching.
Four confirmed zero-days on the same KEV batch, all patching to a three-day deadline, is an elevated operational tempo signal. The SonicWall chain in particular — CVSSs 10.0 and 7.2 working in combination — represents a technically clean attack path against a high-value target class.