CISA 2026-07-14

CISA KEV — SonicWall SMA1000 Appliances (CVE-2026-15409) +3 more

Machine-generated analysis · WAYSCloud LLM

SonicWall SMA1000 appliances are listed with both SSRF and code injection vulnerabilities in the KEV catalog.

Context

The advisory adds CVE-2026-15409 (SSRF) and CVE-2026-15410 (code injection) affecting SonicWall SMA1000 appliances. CISA notes these vulnerabilities are actively exploited and therefore placed in the Known Exploited Vulnerabilities catalog. BOD 26-04 directs federal agencies to prioritize rapid remediation on publicly exposed assets that grant total control after exploitation.

Operator considerations

Check: Identify any SMA1000 appliances on your network and verify whether they are running vulnerable versions.
Isolate: If appliances are publicly reachable, consider segmenting or restricting external access until patches are applied.
Patch: Apply vendor-provided patches or mitigations for CVE-2026-15409 and CVE-2026-15410 as soon as they are available.
Log: Monitor logs for SSRF or unexpected code execution attempts on the affected appliances.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection Vulnerability

CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the...

Read the full advisory on CISA →