CISA KEV Alert: SonicWall SMA1000 & Microsoft Critical Vulnerabilities Under Active Exploit

---
title: SonicWall SMA1000 Potential Exploitation - SSRF and Injection
id: 8a4b2c1d-3e5f-4a6b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential Server-Side Request Forgery (SSRF) or Code Injection attempts against SonicWall SMA1000 appliances based on suspicious URI patterns in web logs.
references:
 - https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.initial_access
 - attack.t1190
 - attack.t1071
logsource:
 category: webserver
 product: sonicwall_sma
detection:
 selection:
 c-uri|contains:
   - 'cgi-bin/'
   - 'portal/'
   - '../'
   - '%2e%2e'
   - 'wget'
   - 'curl'
   - 'nc '
 c-uri|contains|any:
   - '127.0.0.1'
   - '169.254.169.254'
   - 'localhost'
 condition: selection
falsepositives:
 - Administrative testing
 - Misconfigured internal monitoring
level: high
---
title: Microsoft SharePoint Unauthenticated Critical Function Access
id: 9b5c3d2e-4f6a-5b7c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects potential exploitation of CVE-2026-56164 (Missing Authentication) by identifying successful HTTP 200 responses to sensitive SharePoint endpoints without preceding authentication events or from unusual User-Agents.
references:
 - https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 category: webserver
 product: iis
detection:
 selection_uri:
 c-uri|contains:
   - '/_layouts/'
   - '/_api/'
   - '/_vti_bin/'
 selection_status:
 sc-status: 200
 selection_method:
 cs-method: 'POST'
 filter_noise:
 cs-user-agent|contains:
   - 'MSOffice'
   - 'Microsoft Office'
   - 'Microsft-CryptoAPI'
 condition: selection_uri and selection_status and selection_method and not filter_noise
falsepositives:
 - Third-party integration tools accessing APIs anonymously (if configured)
 - Heavy scanning noise
level: high

// Hunt for SonicWall SMA1000 Exploitation Indicators (CEF/Syslog)
// Looks for SSRF patterns and command injection keywords in requests
Syslog
| where SyslogMessage has "SonicWall" 
| extend Uri = extract(@"GET\s+(.*)\s+HTTP", 1, SyslogMessage)
| where Uri has_any ("cgi-bin", "portal", "../", "%2e%2e", "/etc/passwd", "wget", "curl", "powershell") 
       or Uri has_any ("127.0.0.1", "169.254.169", "10.", "192.168.")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, Uri
| order by TimeGenerated desc


// Hunt for SharePoint Suspicious Access related to CVE-2026-56164
// Identify POST requests to API or Layout directories resulting in 200 OK
DeviceNetworkEvents
| where ActionType == "HttpConnectionSuccess"
| where RequestUrl has_any ("/_layouts/", "/_api/", "/_vti_bin/")
| where RequestUrl contains "POST"
| where RemoteIP !in ("192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12") // Focus on external sources initially
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RequestUrl, UserAgent
| order by Timestamp desc

-- Hunt for recent IIS log entries indicating SharePoint exploitation
-- Focus on POST requests to sensitive endpoints returning 200 OK
SELECT * FROM foreach(
  glob(globs='C:\inetpub\logs\LogFiles\**\*.log'),
  {
    SELECT 
      timestamp(string=Date + ' ' + Time) as EventTime,
      c_ip as ClientIP,
      cs_uri_stem as URL,
      cs_method as Method,
      sc_status as HttpStatus,
      cs_user_agent as UserAgent
    FROM parse_csv(filename=_value, delimiter=' ')
    WHERE Method =~ 'POST' 
      AND HttpStatus = '200'
      AND (URL =~ '/_layouts/' OR URL =~ '/_api/' OR URL =~ '/_vti_bin/')
      AND NOT UserAgent =~ 'MSOffice'
    ORDER BY EventTime DESC
    LIMIT 100
  }
)

<#
.SYNOPSIS
    Checks version health for Microsoft SharePoint and AD FS against recent July 2026 CVEs.
.DESCRIPTION
    This script gathers file version information for critical binaries 
    associated with CVE-2026-56155 (AD FS) and CVE-2026-56164 (SharePoint).
    Compare the output versions against the official Microsoft Security Update Bulletin.
#>

Write-Host "[+] Collecting AD FS Service Information..." -ForegroundColor Cyan
try {
    $adfsservice = Get-Service -Name ADFSSrv -ErrorAction SilentlyContinue
    if ($adfsservice) {
        Write-Host "    AD FS Service Status: $($adfsservice.Status)"
        $adfsdll = Get-Item "C:\Windows\ADFS\Microsoft.IdentityServer.Service.dll" -ErrorAction SilentlyContinue
        if ($adfsdll) {
            Write-Host "    Microsoft.IdentityServer.Service.dll Version: $($adfsdll.VersionInfo.FileVersion)"
        } else {
            Write-Host "    [!] Could not locate AD FS binary." -ForegroundColor Yellow
        }
    } else {
        Write-Host "    AD FS Service not found on this host."
    }
} catch {
    Write-Host "    Error checking AD FS: $_" -ForegroundColor Red
}

Write-Host ""
Write-Host "[+] Collecting SharePoint Information..." -ForegroundColor Cyan
try {
    $spreg = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\WSS" -ErrorAction SilentlyContinue
    if ($spreg) {
        Write-Host "    SharePoint Installed Version: $($spreg.ProductVersion)"
        $spwebserver = Get-Item "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\16\bin\Microsoft.SharePoint.dll" -ErrorAction SilentlyContinue
        if ($spwebserver) {
            Write-Host "    Microsoft.SharePoint.dll Version: $($spwebserver.VersionInfo.FileVersion)"
        }
    } else {
        Write-Host "    SharePoint 2016/2019 registry keys not found."
    }
} catch {
    Write-Host "    Error checking SharePoint: $_" -ForegroundColor Red
}

Write-Host ""
Write-Host "[ACTION REQUIRED] Please compare the versions above with the security bulletin released on July 14, 2026." -ForegroundColor Yellow