Critical Zero-Days Exploited in Microsoft Patch Tuesday; SonicWall Vulnerabilities Actively Exploited

Microsoft's July 2026 Patch Tuesday addressed 622 CVEs, including two zero-day vulnerabilities (CVE-2026-56164 in SharePoint and CVE-2026-56155 in AD FS) actively exploited in the wild. Separately, SonicWall SMA1000 appliances are under active exploitation for CVE-2026-15409 and CVE-2026-15410, both rated CVSS 10.0, with a CISA deadline for patching on July 17.

Context

Microsoft's July 2026 Patch Tuesday released fixes for 622 Common Vulnerabilities and Exposures (CVEs), including critical zero-day vulnerabilities in SharePoint and Active Directory Federation Services (AD FS). Zero-day vulnerabilities are particularly dangerous because they are exploited before the vendor has a chance to release a patch. SonicWall has also reported vulnerabilities in its SMA1000 appliances, which are rated as critical and are currently being exploited.

Why it matters

The exploitation of zero-day vulnerabilities poses significant risks to organizations, as these flaws can be used by attackers to gain unauthorized access to systems before they are patched. Microsoft's Patch Tuesday highlights the urgency of addressing these vulnerabilities to protect sensitive data and maintain system integrity. The active exploitation of SonicWall vulnerabilities further emphasizes the need for timely updates and security measures.

Implications

If organizations fail to address these vulnerabilities promptly, they may face data breaches, financial losses, and reputational damage. The active exploitation of these flaws could lead to widespread attacks, affecting businesses and individuals alike. Users of the affected Microsoft and SonicWall products are particularly at risk and must take immediate action to secure their systems.

What to watch

Organizations using Microsoft products should prioritize applying the latest patches to mitigate the risks associated with the identified zero-day vulnerabilities. The July 17 deadline set by CISA for SonicWall users to patch their systems is a critical date to monitor. Continued monitoring of security advisories and updates from both Microsoft and SonicWall will be essential to stay ahead of potential threats.