Daily Cybersecurity
Threat Intelligence

CVE-2026-56164 and CVE-2026-56155: Two Exploited Microsoft Zero-Days Put SharePoint and AD FS at Risk

CVE-2026-56164 and CVE-2026-56155 are actively exploited Microsoft zero-days affecting SharePoint and AD FS.

CVE-2026-56164 and CVE-2026-56155: Two Exploited Microsoft Zero-Days Put SharePoint and AD FS at Risk

This article discusses two zero-day vulnerabilities exploited in the wild, affecting Microsoft SharePoint Server and Active Directory Federation Services. The SharePoint bug is remotely exploitable with no authentication required, while the AD FS flaw enables privilege escalation from a low-privileged position.

CVE-2026-15410 and CVE-2026-15409: SonicWall SMA 1000 Zero-Days Exploited in the Wild

This article reports on two zero-day vulnerabilities in SonicWall SMA 1000 appliances that are being exploited in the wild. The first is a critical unauthenticated SSRF vulnerability, while the second is a post-authentication code injection flaw enabling arbitrary OS command execution.

CVE-2026-15410 and CVE-2026-15409: SonicWall SMA 1000 Zero-Days Exploited in the Wild

SonicWall has patched two actively exploited zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting its SMA 1000 Series secure remote access appliances. CVE-2026-15409 is a critical server-side request forgery (SSRF) flaw in the Workplace interface, allowing unauthenticated attackers to force the device to make unintended requests.

CVE-2026-15410 and CVE-2026-15409: SonicWall SMA 1000 Zero-Days Exploited in the Wild

The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its data leak site.

GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration