KEV Intelligence Brief — July 15, 2026

Prepared for: Federal Contractors · DevOps Teams · Security Operations Leaders Classification: Unclassified // For Official Use Reporting Period: July 7–14, 2026 | KEV Entries Covered: 8

Executive Summary

This week's KEV activity reflects a broader shift in CISA's messaging: enterprise infrastructure—not endpoints—has become the primary battleground.

The latest KEV additions focus on VPN appliances, identity services, SharePoint, legacy Cisco IOS devices, ColdFusion, and internet-facing CMS platforms. At the same time, CISA issued a standalone alert urging organizations to harden on-premises SharePoint deployments following active exploitation of multiple SharePoint vulnerabilities. Combined with this week's Cisco IOS KEV and Monday's joint advisory warning that Russian intelligence continues targeting enterprise routers and switches, the message is clear: attackers are prioritizing the systems that authenticate users, broker remote access, and sit at the edge of enterprise networks.

Four vulnerabilities in this reporting period now carry remediation deadlines that have already passed under Binding Operational Directive (BOD) 26-04, while three additional entries require action before the end of next week.

Operational Context: CISA Elevates SharePoint

The most significant development this week extends beyond the KEV catalog itself.

Following the addition of CVE-2026-56164 to the Known Exploited Vulnerabilities Catalog, CISA released a separate alert urging organizations to immediately harden on-premises Microsoft SharePoint deployments. Rather than focusing solely on the newest vulnerability, the alert references three actively exploited SharePoint vulnerabilities—CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164—indicating that defenders should view the latest KEV as part of an ongoing exploitation campaign rather than an isolated event.

Organizations operating on-premises SharePoint should verify that every supported server has received Microsoft's latest security updates, review hardening guidance, minimize internet exposure wherever possible, and investigate delayed patching for evidence of compromise. The sequence of Microsoft's updates, multiple KEV additions, and now a dedicated CISA alert suggests that SharePoint has become one of the highest-priority enterprise targets this month.

Enterprise Infrastructure Under Sustained Attack

The most time-sensitive KEV cluster centers on SonicWall remote access infrastructure and Microsoft's collaboration and identity platforms.

SonicWall SMA1000 appliances received two simultaneous KEV additions with a July 17 remediation deadline. CVE-2026-15409 is an unauthenticated server-side request forgery (SSRF) vulnerability that can be abused to interact with internal resources through the appliance. CVE-2026-15410 allows authenticated administrators to execute arbitrary operating system commands through code injection. While the vulnerabilities affect different components, their simultaneous exploitation significantly increases operational risk for internet-facing SMA1000 deployments and elevates remediation priority.

Microsoft contributed two additional enterprise infrastructure vulnerabilities. CVE-2026-56164, affecting SharePoint Server, allows an unauthenticated attacker to elevate privileges through a missing authentication check for a critical function. Given CISA's accompanying alert, organizations should treat this as an immediate remediation priority regardless of normal maintenance schedules.

CVE-2026-56155 affects Microsoft Active Directory Federation Services (AD FS), permitting local privilege escalation within one of the enterprise's most sensitive identity systems. Although the remediation deadline extends to July 28, organizations should not interpret the longer compliance window as reduced operational risk. AD FS remains a critical trust anchor, and any compromise within the federation tier warrants careful review of privileged accounts, service accounts, and authentication infrastructure.

Internet-Facing Applications Continue to Drive Initial Access

Application-layer vulnerabilities remain one of the most common paths to enterprise compromise.

CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) illustrate the continuing popularity of unrestricted file upload attacks against CMS ecosystems. Both vulnerabilities allow attackers to place executable payloads onto vulnerable servers, ultimately leading to remote code execution. Balbooa Forms is particularly concerning because exploitation requires no authentication, placing any exposed installation at immediate risk.

Meanwhile, CVE-2026-48282 in Adobe ColdFusion continues a long-running pattern of active exploitation targeting legacy application servers. The path traversal vulnerability can expose sensitive configuration data and facilitate follow-on compromise. Organizations still operating ColdFusion should prioritize emergency remediation and ensure any delayed patching is accompanied by forensic review consistent with CISA guidance.

Legacy Infrastructure Remains an Attractive Target

CVE-2008-4128, affecting Cisco IOS 12.4, demonstrates that attackers continue exploiting legacy infrastructure long after vendor support has ended.

Originally disclosed in 2008, the vulnerability enables privileged command execution through cross-site request forgery against the Cisco IOS HTTP management interface. Although technically old, its addition to the KEV catalog confirms active exploitation against systems that remain deployed.

Its timing is also notable. The KEV addition closely follows CISA's recent joint advisory warning that nation-state actors continue targeting enterprise routers and switches for espionage, credential theft, and long-term network access. Together, the two publications reinforce a consistent operational priority: legacy network infrastructure should receive the same attention as critical servers and identity platforms.

Organizations still operating Cisco IOS 12.4 should disable unnecessary web management interfaces, restrict administrative access to dedicated management networks, and prioritize replacement of unsupported hardware wherever possible.

Intelligence Assessment

This reporting period reinforces an increasingly consistent pattern across recent CISA publications. Rather than pursuing opportunistic endpoint compromises alone, attackers continue focusing on the infrastructure responsible for authentication, remote access, content management, and enterprise networking.

The convergence of SharePoint exploitation, VPN appliance vulnerabilities, identity platform weaknesses, and renewed attention on legacy routers suggests that organizations should prioritize patching and monitoring of enterprise infrastructure before lower-risk endpoint vulnerabilities. For federal agencies and contractors operating under BOD 26-04, compliance remains important—but equally important is recognizing the broader trend behind this week's KEV additions: attackers are systematically targeting the systems that provide the greatest operational leverage once compromised.

Sources: CISA KEV Catalog · CISA BOD 26-04 · SonicWall Security Advisories · Microsoft Security Update Guide · Adobe Security Bulletins · Cisco Security Advisories · CISA Forensics Triage Guidance