Cyber & Technology — 2026-07-16

CISA Adds SonicWall CVSS-10 Zero-Day and Microsoft Flaws to KEV Catalog With July 17 Remediation Deadline

BLUFMicrosoft's phased AD FS fix leaves federal agencies exposed to token-forgery attacks months past CISA's own deadline, undermining the remediation timeline BOD 26-04 was designed to enforce.

CISA on July 14 added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: two SonicWall SMA1000 flaws and two Microsoft flaws disclosed the same day as Microsoft's July Patch Tuesday, which patched a record 622 CVEs, more than triple the prior monthly high 12. CVE-2026-15409, a CVSS-10 unauthenticated server-side request forgery in the SMA1000 WorkPlace interface, and CVE-2026-15410, a CVSS-7.2 post-authentication code injection flaw in the Appliance Management Console, were reported by SonicWall's PSIRT as under active exploitation based on investigation of multiple incidents 2. The Microsoft entries are CVE-2026-56155, a CVSS-7.8 access-control weakness in Active Directory Federation Services affecting the Distributed Key Manager container that Microsoft's own Detection and Response Team uncovered during incident-response work, and CVE-2026-56164, a missing-authentication flaw in SharePoint Server that Microsoft classified as an elevation of privilege confirmed exploited as a zero-day and that Mandiant and Google's FLARE team discovered 3. CISA set a remediation deadline of July 17 for three of the four CVEs, with CVE-2026-56155 given until July 28, under Binding Operational Directive 26-04 governing FCEB agency vulnerability management 14.

Analysis
CISA's split deadline tracks differentiated risk rather than a coordinated cross-vendor campaign: the AD FS access-control flaw understates its severity, letting a local attacker read token-signing key material and forge federated authentication, and Microsoft's fix only logs the insecure ACL until agencies opt in, with automatic enforcement deferred to October 13, past CISA's own July 28 window for that CVE. The SharePoint and SonicWall SSRF flaws need no credentials and stay reachable from the open internet until patched, unlike the AD FS and SonicWall code-injection bugs that require an existing foothold. BOD 26-04 also mandates a prior-compromise check before patching, a forensic step the deadline alone doesn't capture. Sourcing stays thin: CISA's KEV advisory is the only primary account, with Security Affairs, Quasa, and Windows News repackaging it and vendor bulletins rather than adding independent reporting.

4 sources