CISA Adds Four Known Exploited Vulnerabilities to Catalog

Key Points:

• CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including CVE-2026-15409, CVE-2026-15410, CVE-2026-56155, and CVE-2026-56164.
• These vulnerabilities pose significant risks to federal systems, allowing for potential exploitation that could grant attackers total control over affected assets.
• Organizations are urged to prioritize rapid remediation of these high-risk vulnerabilities as per Binding Operational Directive 26-04.

Technical Details: The vulnerabilities include a Server-Side Request Forgery in SonicWall appliances (CVE-2026-15409), a Code Injection vulnerability in SonicWall appliances (CVE-2026-15410), insufficient access control in Microsoft Active Directory Federation Services (CVE-2026-56155), and missing authentication in Microsoft SharePoint Server (CVE-2026-56164).

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned