Active Exploitation Confirmed: SonicWall SMA1000 and Microsoft AD FS/SharePoint Flaws Added to CISA KEV

As reported by CISA in their July 14, 2026 advisory, four vulnerabilities spanning SonicWall and Microsoft enterprise platforms have been added to the Known Exploited Vulnerabilities (KEV) Catalog — confirming that threat actors are actively leveraging these flaws in the wild. For security teams, KEV additions are not informational notices; they are operational fire alarms.

Vulnerability Summary

Note: CVSS scores were not published in the CISA advisory at time of writing. Consult SonicWall PSIRT and Microsoft Security Update Guide for vendor-specific severity ratings.

Why This Combination Should Alarm Defenders

What makes this KEV batch particularly dangerous is the attack surface diversity. These are not obscure edge-case vulnerabilities — they sit at the intersection of remote access infrastructure, identity federation, and enterprise collaboration. Attackers exploiting these flaws don't need to be sophisticated; they need to find one organization that hasn't patched.

The two SonicWall SMA1000 vulnerabilities are especially concerning when considered together. An SSRF flaw like CVE-2026-15409 is frequently used to pivot into internal networks and bypass perimeter controls — essentially turning a trusted appliance into an attacker-controlled proxy. When chained with a code injection vulnerability like CVE-2026-15410, the attack path becomes devastatingly straightforward: probe internal services via SSRF, then inject and execute malicious code on the appliance itself. SonicWall secure access products have historically been high-value targets for ransomware groups and nation-state actors precisely because they sit on the network perimeter with privileged access to internal resources.

On the Microsoft side, CVE-2026-56155 in AD FS targets the identity layer — the trust backbone of hybrid enterprise environments. Access control granularity failures in a federation service can allow attackers to escalate privileges, impersonate users, or bypass conditional access policies. Meanwhile, CVE-2026-56164 in SharePoint — a missing authentication check for a critical function — represents one of the most exploitable vulnerability classes in enterprise software. Unauthenticated access to critical SharePoint functions can lead directly to data exfiltration, malicious file uploads, or lateral movement through document workflows.

Who Is Most at Risk

The KEV Catalog as a Prioritization Signal

"CISA's KEV listing means threat actors are not just theoretically capable of exploiting these vulnerabilities — they already are. Every day without a patch is a day of confirmed exposure."

Security teams that maintain vulnerability queues based solely on CVSS scores frequently deprioritize issues that are actively being weaponized. The KEV Catalog exists precisely to bridge that gap. A medium-CVSS vulnerability with confirmed exploitation in the wild is categorically more dangerous than a theoretical critical-CVSS flaw with no public exploit. Patch management programs that do not integrate KEV data are operating with incomplete threat intelligence.

Shield53 Recommendations — Immediate Actions

SonicWall SMA1000 (CVE-2026-15409 & CVE-2026-15410)

• Apply SonicWall's latest firmware patch immediately. Consult the SonicWall PSIRT portal for the specific patched version for your appliance model
• Audit SMA1000 management interface exposure — restrict access to known IP ranges via ACL; management interfaces should never be directly internet-accessible
• Review appliance logs for anomalous outbound requests (SSRF indicators) and unexpected process execution events
• If patching cannot be completed within 24–48 hours, evaluate temporary isolation of the appliance and alternate remote access paths
• Threat hunt for indicators of compromise on systems reachable via the SMA1000 — assume the appliance may have been used as a pivot point

Microsoft AD FS (CVE-2026-56155)

• Apply the relevant Microsoft Security Update immediately — check the Microsoft Security Response Center for patch availability and KB article
• Audit AD FS claim rules and relying party trust configurations for unauthorized modifications
• Review AD FS event logs (Event IDs 1200, 1201, 1202, 411) for anomalous token issuances or failed authentication patterns
• Consider accelerating migration to Microsoft Entra ID where feasible — legacy AD FS deployments carry compounding risk
• Enable Azure AD Connect Health monitoring if hybrid-joined to detect federation anomalies

Microsoft SharePoint Server (CVE-2026-56164)

• Apply the Microsoft-provided patch without delay; missing authentication flaws in SharePoint have historically been exploited within hours of public disclosure
• Audit SharePoint ULS logs for unauthenticated or anonymous requests to critical API endpoints
• Verify SharePoint Server is not directly exposed to the internet — all access should route through a WAF or reverse proxy with authentication enforcement
• Review file upload and storage locations for unexpected or malicious content

Cross-Cutting Guidance

• Integrate CISA's KEV Catalog feed directly into your vulnerability management platform as a mandatory prioritization tier
• Per BOD 26-04 requirements (applicable to FCEB, recommended for all), assess whether threat actors may have accessed systems before patches were applied and initiate compromise assessment procedures accordingly
• Brief executive leadership — active exploitation of identity and remote access infrastructure carries potential for significant business impact and regulatory notification obligations