U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog


U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog

Pierluigi Paganini
July 15, 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities (KEV) catalog.

The flaws added to the catalog are:

  • CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
  • CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection Vulnerability
  • CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
  • CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

This week, SonicWall confirmed the active exploitation of two zero-day vulnerabilities affecting Secure Mobile Access (SMA) 1000 appliances. The vulnerabilities were internally discovered and reported by Adam Babis of the company’s PSIRT.

The company investigated multiple incidents indicating these vulnerabilities are being actively exploited in the wild.

The first vulnerability, tracked as CVE-2026-15409 (CVSS score of 10.0), is a Server-side request forgery (SSRF) issue that a remote unauthenticated attacker could exploit to potentially cause the appliance to make requests to an unintended location.

“A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.” reads the advisory.

The second vulnerability, tracked as CVE-2026-15410 (CVSS score of 7.2), is a post-authentication code injection flaw in the Appliance Management Console (AMC) that a remote authenticated attacker could exploit to execute arbitrary operating system commands as administrator under certain conditions.

“Post-authentication improper control of generation of code (‘Code Injection’) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.” continues the advisory. “SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory.”

Regarding the other two issues added to the KEV catalog this month, Microsoft’s July 2026 Patch Tuesday security updates fixed a record 621 CVEs, including two that are being actively exploited as zero-days.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to urgently fix the vulnerabilities by July 17, 2026, except CVE-2026-56155, which must be addressed by July 28, 2026

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


More than $18.4 Million Available to Expand HealthySteps, an Early Childhood Mental Health Initiative that Screened 108,000 New Yorkers for Maternal Depression in 2025

Office of Mental Health Awards $350,000 in ‘Collaborative Care’ Grants to Help OBGYN and Family Medicine Practices Provide Behavioral Health Support to Patients

New York State Announces Efforts to Bolster Maternal Mental Wellbeing

The New York State Office of Mental Health recently announced the availability of more than $18.4 million to expand HealthySteps, a successful early childhood mental health initiative that provides tens of thousands of critical depression screenings for new mothers annually. The agency also announced $350,000 in awards through the Collaborative Care program to help OBGYN and family medicine practices provide behavioral health support to their patients.

“It is critical that we focus on maternal mental health and develop the preventative services and supports for families in our state that address the long-standing inequities in care,” Office of Mental Health Commissioner Dr. Ann Sullivan said. “Initiatives like HealthySteps, Collaborative Care, Project TEACH and others are providing often life-saving screenings that are also connecting New Yorkers to both prenatal and postpartum supports. Under Governor Kathy Hochul’s leadership, we are increasing prevention services to improve outcomes and eliminating disparities in care.”

“I am grateful to Governor Hochul for her leadership in advancing maternal mental health initiatives in New York State that expand access to critical screenings and services,” Health Commissioner Dr. James McDonald said. “In recognition of Maternal Mental Health Awareness Week, we are reminded that every mother deserves compassion, support, and quality care. We remain committed to ensuring that all mothers feel supported, heard, and empowered.”

The state Office of Mental Health made available more than $18.4 million to continue expanding HealthySteps, an innovative program integrating behavioral health professionals with pediatric practices to provide early childhood mental and physical health care. The additional funding will provide 38 new awards to the 152 sites now funded, increasing statewide capacity of the program by about 25 percent once all are fully implemented.

HealthySteps pairs behavioral health specialists with pediatricians, who are often the first point-of-contact new caregivers have with the health care system. These specialists then serve as part of the primary care team during well visits, screening children and parents for a variety of concerns including behavioral health, developmental concerns and social determinants of health and family needs and then linking them to supports.

In 2025 alone, HealthySteps sites completed more than 108,000 screenings for perinatal depression, identifying cases and connecting parents to support when needed. Altogether, these sites conducted more than 500,000 screenings, helping to track food insecurity, housing instability, substance misuse, tobacco use, transportation, utility, and interpersonal safety.

In addition to the funding availability, OMH also awarded seven $50,000 one-time Collaborative Care grants to help OBGYN and family medicine practices implement evidence-based integrated healthcare for their patients and decrease racial disparities. Award recipients by region include:

Hudson Valley

New York City

  • Jamaica Hospital in Queens
  • Montefiore Medical Center in the Bronx
  • William F. Ryan Community Health Center, Inc., in Manhattan

Western New York

  • Jericho Road Ministries, Inc., in Buffalo
  • Neighborhood Health Center of WNY in Buffalo
  • Niagara Falls Memorial Medical Center in Niagara Falls

This funding will expand the psychiatric collaborative care model at these practices so they can increase perinatal depression and anxiety screenings and integrated treatment — a recommendation included in the state’s first-ever maternal mental health report. Directed by Governor Hochul and released by OMH in November, this report detailed the challenges pregnant and postpartum individuals are facing and made recommendations for improvements statewide.

Previously, Governor Hochul secured a $2.9 million increase to expand Project TEACH, an initiative that assists maternal health providers with screening and treatment of maternal depression and related mood and anxiety disorders during pregnancy and the postpartum period within their scope of practice. Adopted as part of the FY 2026 State Budget, the expansion has allowed a wider range of front-line practitioners – including doulas, midwives, therapists, WIC staff, home visiting nurses, lactation consultants, caseworkers and others working directly with the perinatal population – to obtain professional training and support in assessment for consultations with a reproductive psychiatrist or psychologist, and accessing resources.

Every year, an estimated 500,000 – about one in five – mothers in the United States experience perinatal mood and anxiety disorders during pregnancy or in the first year postpartum. About 75 percent of these individuals are not diagnosed or treated, which can lead to high-risk pregnancies, poor childhood cognitive development due to substance use, self-harm, or suicide.

View the original source here.



Source link