--- title: "Security digest: July 14, 2026" url: https://erroneo.us/security/2026-07-14/ description: "July 14, 2026 vulnerability digest: 6 briefs (SonicWall SMA1000: Two Rounds of Exploited…); 4 CISA KEV additions (Microsoft, SonicWall); 5 critical…" type: security-digest-day section: "Security Digest" date_published: 2026-07-14 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: July 14, 2026 6 editorial briefs, 4 known exploited (cisa kev) additions and 5 critical advisories. ## Take stock - Act now: SonicWall SMA1000: Two Rounds of Exploited Zero-Days . Anyone operating SonicWall SMA1000 (6210, 7210, 8200v) appliances on 12.4.3-03453 / 12.5.0-02835 or older, physical or virtual. - Act now: SharePoint: Four July-August 2026 Flaws Now Exploited . Anyone running on-premises SharePoint Server Subscription Edition, 2019 or 2016, above all farms reachable from the internet or allowing anonymous access. - Act now: Sangoma Switchvox CVE-2026-9586: Pre-Auth SQLi to RCE . Anyone running an on-premises Sangoma Switchvox phone system below 8.4.0.2, most urgently where its web interface is reachable from the internet. - Act now: SharePoint CVE-2026-56164: Exploited Unauthenticated 0-Day . Anyone running on-premises SharePoint Server Subscription Edition, 2019 or 2016, especially farms published to the internet. - Patch this week: AD FS CVE-2026-56155: Exploited EoP via Weak DKM Key ACLs . Organizations running AD FS on Windows Server 2012 through 2025, especially farms first built on Server 2012 or 2012 R2 and any farm that has not yet installed the October 13, 2026 update. - Check exposure: AsyncAPI npm Packages Backdoored via pull_request_target . Anyone whose lockfile, cache or CI run picked up @asyncapi/specs 6.11.2 or 6.11.2-alpha.1, @asyncapi/generator 3.3.1, generator-helpers 1.1.1 or generator-components 0.7.1 on or after July 14, 2026, including via transitive dependencies. - Do you run any of these? Microsoft SharePoint Server, Microsoft Active Directory Federation Services, SonicWall SMA1000 Appliances. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-17. - npm: 2 critical advisories ( n8n-mcp , tidgi ). Check with npm audit (or: npm ls ) . - Composer (PHP): 2 critical advisories ( facturascripts/facturascripts ). Check with composer audit . - Go: 1 critical advisory ( github.com/julien040/anyquery ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [SonicWall SMA1000: Two Rounds of Exploited Zero-Days](https://erroneo.us/security/briefs/sonicwall-sma1000-zero-days-cve-2026-15409-83548/index.md): If you run an SMA1000 appliance, install the September hotfix and check it for compromise today; the July fix alone does not cover the second pair of exploited bugs. - **Act now** [SharePoint: Four July-August 2026 Flaws Now Exploited](https://erroneo.us/security/briefs/sharepoint-cve-2026-58644-50522-55040-65660-exploited/index.md): Any on-premises SharePoint farm not yet on the August 2026 builds is exposed to exploited bugs with public exploit code; patch, rotate machine keys and check for compromise now. - **Act now** [Sangoma Switchvox CVE-2026-9586: Pre-Auth SQLi to RCE](https://erroneo.us/security/briefs/sangoma-switchvox-cve-2026-9586-pre-auth-sqli-rce/index.md): A single unauthenticated request turns an unpatched Switchvox PBX into a shell; if yours is below 8.4.0.2 and reachable from the internet, upgrade today and check it for compromise. - **Act now** [SharePoint CVE-2026-56164: Exploited Unauthenticated 0-Day](https://erroneo.us/security/briefs/sharepoint-cve-2026-56164-zero-day/index.md): Ignore the modest vendor score: this was exploited as a zero-day against on-prem SharePoint, so internet-facing farms need the July 2026 updates, a machine-key rotation and a compromise check now. - **Patch this week** [AD FS CVE-2026-56155: Exploited EoP via Weak DKM Key ACLs](https://erroneo.us/security/briefs/microsoft-ad-fs-cve-2026-56155-dkm-acl-privilege-escalation/index.md): If you run AD FS, install the October 2026 or later Windows update on every farm server this week and confirm the DKM container ACL was fixed; unless you opted in, the July patch only flagged the weak permissions. - **Check exposure** [AsyncAPI npm Packages Backdoored via pull_request_target](https://erroneo.us/security/briefs/asyncapi-npm-pwn-request-miasma-rat/index.md): If any build resolved @asyncapi/specs 6.11.2 or the July 14 generator releases, treat that machine as backdoored; everyone else should still fix their own pull_request_target workflows. ## Known exploited (CISA KEV) - [CVE-2026-56164](https://erroneo.us/security/cve/CVE-2026-56164/index.md) Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability (CISA due 2026-07-17) - [CVE-2026-56155](https://erroneo.us/security/cve/CVE-2026-56155/index.md) Microsoft Active Directory Federation Services: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability (CISA due 2026-07-28) - [CVE-2026-15410](https://erroneo.us/security/cve/CVE-2026-15410/index.md) SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Code Injection Vulnerability (CISA due 2026-07-17) - [CVE-2026-15409](https://erroneo.us/security/cve/CVE-2026-15409/index.md) SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (CISA due 2026-07-17) ## Critical advisories - [CVE-2026-50006](https://erroneo.us/security/cve/CVE-2026-50006/index.md) Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode — Go github.com/julien040/anyquery < 0.4.5 → no fix - [CVE-2026-54052](https://erroneo.us/security/cve/CVE-2026-54052/index.md) n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments — npm n8n-mcp <= 2.56.0 → 2.56.1 - [GHSA-hgjx-r89m-m7v4](https://erroneo.us/security/ghsa/GHSA-hgjx-r89m-m7v4/index.md) FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE — Composer (PHP) facturascripts/facturascripts >= 2025, <= 2026.2 → no fix - [GHSA-9hc2-hjx8-q6pv](https://erroneo.us/security/ghsa/GHSA-9hc2-hjx8-q6pv/index.md) TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution — npm tidgi <= 0.13.0 → no fix - [CVE-2026-45262](https://erroneo.us/security/cve/CVE-2026-45262/index.md) FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` — Composer (PHP) facturascripts/facturascripts <= 2026.1 → no fix --- Source page: https://erroneo.us/security/2026-07-14/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt