Corrected on 9 October 2026
We cited SonicWall's advisory as SNWLID-2026-0009, but that one covers SonicOS (CVE-2026-0516). CVE-2026-15409 and CVE-2026-15410 in SMA1000 are in SNWLID-2026-0008 of 14 July 2026; the number was corrected and the advisory added as a source. The conclusion doesn't change.
CISA doesn't add vulnerabilities to KEV on theory. It adds them when it sees proven exploitation in the real world. On 14 July, four new CVEs landed at once, from three different vendors, across three different surfaces - collaboration, perimeter and identity. Not a routine Friday list.
Fact
The facts: CISA added to KEV on 14.07.2026 - CVE-2026-56164 (Microsoft SharePoint Server, missing authentication for a critical function, unauthenticated privilege escalation, deadline for federal agencies 17.07); CVE-2026-15409 (SonicWall SMA1000, unauthenticated SSRF in the WorkPlace interface, CVSS 10.0, affects models 6210, 7210 and 8200v, patch available - hotfix 12.4.3-03453 / 12.5.0-02835+, deadline 17.07); CVE-2026-15410 (SonicWall SMA1000, authenticated code injection in the management console, CVSS 7.2, chains with 15409 into full unauthenticated RCE, deadline 17.07); CVE-2026-56155 (Microsoft AD FS, insufficient granularity of access control, authenticated privilege escalation, deadline 28.07). All four - confirmed active exploitation. Source: CISA Known Exploited Vulnerabilities Catalog; SonicWall PSIRT advisory SNWLID-2026-0008.
What's the risk here - not the individual bug, the combination. SonicWall SMA1000 sits on the perimeter, exactly where nobody wants unauthenticated access. A score of 10.0 means the ceiling. There's nothing higher. The second bug in it doesn't stand alone - it turns the first from a serious problem into an open door to full control. Add SharePoint, add AD FS, and you have perimeter, identity and collaboration breached all at once. If you run infrastructure, there's very concrete work here for the weekend.
Don't look at the CVE numbers one by one - perimeter, identity and collaboration fell on the same day.
Got SonicWall SMA1000, SharePoint Server on a public address, or AD FS in your identity stack - the patches wait until the 17th, the 28th at the latest. Don't wait for a maintenance window. CISA only puts something in KEV after confirmed exploitation, never on theory.
Sources
CISA - Known Exploited Vulnerabilities CatalogSonicWall PSIRT - SNWLID-2026-0008: SMA1000 (CVE-2026-15409, CVE-2026-15410), 14.07.2026The visual is generated code-art, no third-party images.