CISA Adds 2 Sonic Wall Vulnerabilities to KEV Catalog – 7-14-26

Today, CISA announced that it had added two vulnerabilities in the Sonic Wall SMA1000 Appliance Work Place interface. Sonic Wall disclosed the two vulnerabilities earlier today; noting that they had "investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory.” Sonic wall has a new version that mitigates the vulnerabilities and provides indicators of compromise in their advisory. 

The two reported vulnerabilities are: 

• Server-Side request forgery - CVE-2026-15409, and 
• Code Injection - CVE-2026-15410 

CISA has directed federal agencies to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04, Prioritizing Security Updates Based on Risk guidance, and CISA’s “Forensics Triage Requirements”. They were also told to follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. A compliance deadline of July 17th, 2026, has been established. 

Review - Public ICS Disclosure – Week of 10-30-21

This week we have 14 vendor disclosures from Beckhoff, Boston Scientific, Hitachi, Hitachi Energy (7), HPE, Philips, Phoenix Contacts, and Tanzu. There is also a researcher report about vulnerabilities in products from Gerbv. Finally, there is an exploit for products from Sonicwall.

Beckhoff Advisory - Beckhoff published an advisory describing a relative path traversal vulnerability in their TwinCAT OPC UA Server.

Boston Scientific Advisory - Boston Scientific published an advisory discussing the PrintNightmare vulnerabilities.

Hitachi Advisory - Hitachi published an advisory discussing 35 vulnerabilities in their Hitachi Disk Array Systems.

Hitachi Energy Advisory #1 - Hitachi published an advisory discussing 36 vulnerabilities in their Transformer Asset Performance Management (APM) Edge products.

Hitachi Energy Advisory #2 - Hitachi published an advisory describing an insufficient security control vulnerability in their Relion® 670/650/SAM600-IO series Products.

Hitachi Energy Advisory #3 - Hitachi published an advisory describing an insufficient security control in their GMS600 generator circuit breakers.

Hitachi Energy Advisory #4 - Hitachi published an advisory describing an insufficient security control vulnerability in their PWC600 controllers.

Hitachi Energy Advisory #5 - Hitachi published an advisory describing an insecure boot image vulnerability in their Relion® 670/650/SAM600-IO series Products.

Hitachi Energy Advisory #6 - Hitachi published an advisory describing an authentication bypass vulnerability in their Counterparty Settlement and Billing (CSB) Product.

Hitachi Energy Advisory #7 - Hitachi published an advisory describing an authentication bypass vulnerability in their Retail Operations Product.

HPE Advisory - HPE published an advisory discussing five vulnerabilities in their Edgeline EL300 Converged Edge Systems.

Philips Advisory - Philips published an advisory discussing the Cisco input validation vulnerability.

Phoenix Contacts Advisory - Phoenix Contacts published an advisory describing a ‘zip-slip’ vulnerability in their Automation Worx Software Suite.

Tanzu Advisory - Tanzu published an advisory discussing a missing release of memory after effective lifetime vulnerability in their Spring Cloud Gateway.

Gerbv Report - Talos published a report about an out-of-bounds write vulnerability in the in the drill format T-code tool number functionality of Gerbv 2.7.0.

Sonicwall Exploit - Vulnerability Labs published an exploit for a cross-site scripting vulnerability in the Sonicwall SonicOS.

For more details about these advisories, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-10 - subscription required.