IT security 2026-07-15

Level Critical — 89/100 — 2026-07-15

Critical day: 30 stories ranked, 6 of the top 10 reported as actively exploited, 6 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (79/100).

  1. SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability — 79/100 (CVE-2026-15409)
  2. Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability — 74/100 (CVE-2026-56164)
  3. SonicWall SMA1000 Appliances Code Injection Vulnerability — 73/100 (CVE-2026-15410)
  4. Oracle E-Business Suite Improper Privilege Management Vulnerability — 67/100 (CVE-2026-46817)
  5. Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability — 62/100 (CVE-2026-56155)
  6. KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability — 61/100 (CVE-2023-4346)
  7. CVE-2026-48356 — Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could res… — 47/100 (CVE-2026-48356)
  8. apache kylin: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in A… — 33/100 (CVE-2026-62392)
  9. adobe coldfusion: ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code exec… — 32/100 (CVE-2026-48284)
  10. microsoft sql server 2016: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a networ… — 32/100 (CVE-2026-54117)