CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Intelligence Brief — July 17, 2026
Issued: Friday, July 17, 2026 | Audience: Federal Contractors, DevOps, Security Operations | Scope: CISA KEV Additions, July 14–16, 2026
Three days of KEV additions this week produced eight entries spanning network security appliances, enterprise collaboration platforms, OT building automation, and identity infrastructure. The deadline picture is severe: two patches were due yesterday, two more expire tomorrow, and a third cluster closes within days. Organizations still triaging should re-read that sentence before reading further.
Overdue and Imminent: Network Edge Appliances at Maximum Exposure
The week's most time-critical entries center on SonicWall and Fortinet — two vendors whose edge products have become reliable targets for state-sponsored actors and ransomware operators alike.
SonicWall SMA1000 Appliances drew two simultaneous KEV additions on July 14 with a patch deadline of July 17 — today. CVE-2026-15409 is a server-side request forgery (SSRF) flaw allowing unauthenticated remote attackers to force the appliance to issue arbitrary internal requests, a classic pivot technique for mapping segmented networks or hitting internal APIs. CVE-2026-15410 is a code injection vulnerability that, under specific conditions, lets an authenticated administrator-level attacker execute arbitrary OS commands. Read together, these two flaws sketch a plausible kill chain: exploit SSRF to probe internal trust relationships or extract tokens, escalate to admin, then achieve OS-level command execution. Any SMA1000 deployment that is internet-facing and unpatched as of today should be treated as potentially compromised. Isolate the appliance from internal network segments immediately, initiate forensic triage per BOD 26-04 Forensics Triage Requirements, and rotate all credentials and session tokens associated with the device before reintroducing it to production.
Fortinet FortiSandbox adds two more OS command injection vulnerabilities — CVE-2026-25089 and CVE-2026-39808 — with a patch deadline of July 19. Both are unauthenticated and reachable via crafted HTTP requests, meaning no prior foothold is required. Critically, the scope extends to FortiSandbox Cloud and FortiSandbox PaaS deployments, which adds pressure on teams who may have deprioritized patching under the assumption that cloud-managed services carry less risk. They do not. BOD 26-04 explicitly addresses cloud services: apply vendor mitigations or discontinue use. For on-premises FortiSandbox deployments, confirm the management interface is not exposed to untrusted networks and apply Fortinet's advisory patches before Sunday. Log all inbound HTTP requests to the FortiSandbox management plane for the past 30 days and flag anomalous patterns consistent with reconnaissance or exploitation attempts.
Enterprise Platform Takeover: SharePoint and Oracle Payments in Active Crosshairs
Two entries targeting widely deployed enterprise platforms carry both high impact and substantial organizational footprint, making lateral movement post-exploitation especially dangerous.
Microsoft SharePoint (CVE-2026-58644, deadline July 19) contains a deserialization of untrusted data vulnerability enabling unauthenticated network-based code execution. Deserialization RCE on SharePoint is a well-worn attacker playbook — it has appeared in multiple previous KEV entries and APT campaigns — because SharePoint instances routinely hold sensitive documents, credentials, and workflow integrations. Organizations running on-premises SharePoint 2019 or SharePoint Server Subscription Edition should treat this as a critical-priority patch. Verify internet exposure of your SharePoint web application tier; if it is externally routable without VPN or zero-trust enforcement, consider temporarily restricting access at the perimeter while the patch is applied.
Oracle E-Business Suite (CVE-2026-46817, deadline July 18 — tomorrow) presents one of the highest-consequence entries in this batch: an improper privilege management flaw in the Oracle Payments module that allows a completely unauthenticated attacker with HTTP network access to achieve full takeover of Oracle Payments. This is a payment processing system. The implications for financial integrity, PCI-DSS scope, and fraud risk are immediate. If patching by tomorrow is not achievable, Oracle Payments interfaces should be blocked at the network layer and an emergency change control initiated. Document the compensating control and timeline per BOD 26-04 requirements.
Identity Infrastructure and OT: Longer Deadlines, Broader Blast Radius
Two entries carry longer remediation windows but represent structural risks that deserve planning attention now rather than the day before deadline.
Microsoft Active Directory Federation Services (CVE-2026-56155, deadline July 28) contains an insufficient access control granularity vulnerability enabling local privilege escalation by an already-authorized attacker. The keyword here is "authorized attacker" — this is an insider threat and post-compromise lateral movement scenario. AD FS sits at the center of federated identity for Microsoft 365, Azure, and countless SAML-integrated SaaS applications. A threat actor who has established even limited access to an AD FS server can leverage this flaw to elevate to SYSTEM and forge or manipulate token issuance. Audit AD FS server access logs now; the patch window extends to July 28, but detection should begin immediately.
KNX Association KNX Protocol (CVE-2023-4346, deadline July 29) is notable for its age — a 2023 CVE only now reaching confirmed exploitation — and for its target domain: building automation systems. This overly restrictive lockout mechanism flaw allows an attacker to purge KNX bus devices and set a BCU key, effectively bricking or locking building control devices including HVAC, lighting, and access control systems. Federal facilities and critical infrastructure operators using KNX-based building management systems should audit network segmentation between IT and OT/BMS networks, confirm whether KNX devices are reachable from untrusted segments, and coordinate with facilities teams on patching or compensating controls before month-end.
Summary Deadline Table:
| Deadline | CVEs | Products | |---|---|---| | July 17 (TODAY) | CVE-2026-15409, CVE-2026-15410 | SonicWall SMA1000 | | July 18 (TOMORROW) | CVE-2026-46817 | Oracle E-Business Suite | | July 19 | CVE-2026-25089, CVE-2026-39808, CVE-2026-58644 | FortiSandbox, SharePoint | | July 28 | CVE-2026-56155 | Microsoft AD FS | | July 29 | CVE-2023-4346 | KNX Protocol |
Sources: CISA KEV Catalog · CISA BOD 26-04 · Fortinet PSIRT Advisories · SonicWall Security Advisories · Microsoft Security Response Center · Oracle Critical Patch Update · CISA ICS Advisory (KNX)
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — July 20, 2026
Active Exploitation Underway Against Gitea, WordPress, and Windows Systems
Threat actors are actively probing CVE-2026-20896, a critical flaw in Gitea Docker images, with first exploitation attempts detected just 13 days after public disclosure. Separately, the WordPress wp2shell vulnerability previously reported has been confirmed as a pre-authentication remote code execution flaw affecting default installations, allowing anonymous attackers to compromise sites without valid credentials. Microsoft systems face a new threat as security researcher Nightmare Eclipse released a Windows zero-day exploit called LegacyHive that grants attackers admin privileges on fully patched Windows systems—no patch is currently available.
AI-Powered Attack Surfaces Expand as Hugging Face Breached by Autonomous Agent
Open-source AI platform Hugging Face confirmed unauthorized access to internal datasets and service credentials after compromise by an autonomous AI agent system. During incident response, the security team encountered operational friction when unnamed US frontier LLM guardrails blocked threat analysis queries, forcing responders to pivot to Chinese language models to continue investigation work. The breach highlights emerging attack vectors in AI infrastructure, where automated agent systems can execute multi-step intrusion campaigns. Meanwhile, Russian government agencies are being targeted through compromised ViPNet VPN software, leveraging the platform's widespread deployment across high-value organizations to maintain persistent access.
Sources: The Hacker News · GB Hackers · Bleeping Computer · The Stack · WIU Cybersecurity Center · Bleeping Computer
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
New Windows LegacyHive zero-day gives hackers admin privileges
A security researcher using the Nightmare Eclipse handle released a Windows zero-day exploit called LegacyHive that allows attackers to escalate privi...
Hugging Face Attacked by Autonomous AI Agent — GhostCommit and Other AI Attack Vectors Disclosed
Multiple AI-integrated systems became attack surfaces this week, including Hugging Face breach by autonomous AI agent and novel security threats like ...
Hugging Face hacked: Turned to Chinese LLM for help after US models blocked Blue Team
The platform's security team were initially stymied in their incident response (IR) by unnamed US LLM frontier model guardrails “which cannot ...
Fairlife pauses US production after cyberattack breached milk brand's systems - ABC News
Ransomware attacks — in which hackers demand a hefty payment to restore hacked systems — also account for a growing share of cyber crimes. And ...
Cybersecurity risks posed by over-the-air tech in autos has analysts concerned - CNBC
The automotive industry's increasing use of over-the-air technology makes it more susceptible to cyberattacks, analysts say.
Chicago-based Fairlife pauses US production after ransomware cyberattack breaches milk ...
Chicago-based Fairlife has paused US production after a ransomware cyberattack breached the milk brand's systems. They're owned by Coca-Cola.
Abbott discloses cyberattack on cancer diagnostics business - Cybersecurity Dive
The cyberattack follows Abbott's recent $21 billion purchase of Exact Sciences. Abbott did not disclose what kind of information was accessed.
China-Linked APT Expands Arsenal With New 'Leash' Backdoors
Chinese APT group UAT-7810 has expanded its espionage infrastructure arsenal with new backdoors including LongLeash, DogleAsh, and JarLeash tools targ...
Updated daily