CISA adds an actively exploited SharePoint auth-bypass and two SonicWall SMA1000 flaws to KEV

Sources: CISA KEV catalog
Summary: CISA updated the Known Exploited Vulnerabilities catalog to version 2026.07.14 (count 1642), adding four entries dated 2026-07-14. CVE-2026-56164 is a missing-authentication-for-critical-function flaw in Microsoft SharePoint Server that lets an unauthenticated attacker elevate privileges over the network, with a federal remediation due date of 2026-07-17. CVE-2026-15409 and CVE-2026-15410 are a server-side request forgery reachable pre-authentication and an authenticated administrator command-injection flaw in SonicWall SMA1000 appliances, both due 2026-07-17. CVE-2026-56155 is an access-control granularity flaw in Microsoft Active Directory Federation Services allowing local privilege elevation, due 2026-07-28.
Why it matters: The three-day remediation window on the SharePoint and SonicWall entries signals active exploitation of internet-facing enterprise identity and access infrastructure, and SonicWall SMA1000 has a repeated history as an exploited edge target.