CISA KEV July 17 Deadline: NC SMB Emergency Patch Playbook 2026

TL;DR: July 17, 2026 is the CISA-set patch deadline for three actively exploited zero-days added to the Known Exploited Vulnerabilities (KEV) catalog on July 14: SonicWall SMA1000 CVE-2026-15409 (CVSS 10.0 unauthenticated SSRF), SonicWall SMA1000 CVE-2026-15410 (CVSS 7.2 post-auth code injection, chained yields unauth RCE as admin), and Microsoft SharePoint CVE-2026-56164 (on-premises missing-authentication elevation of privilege). Microsoft AD FS CVE-2026-56155 (elevation of privilege) is on the July 28 track. The CISA deadlines are binding on federal civilian agencies under BOD 26-04, but they are the operational floor NC SMB cyber-insurance carriers, DFARS/CMMC assessors, and boards now expect their small-business insureds and contractors to meet on the same clock.

Key takeaway: July 17 is not a federal-only date. It is the date every CISO-in-title-only at every NC SMB with a SonicWall SMA1000, an on-premises SharePoint, or an AD FS server should have already scheduled a change window, applied the fixed builds, and documented the attestation in a location their cyber-insurance broker can pull without a phone call.

Do you run a SonicWall SMA1000, on-premises SharePoint, or AD FS in your environment? Contact Preferred Data Corporation for same-week emergency patch application, credential rotation, compromise hunt, and cyber-insurance attestation packet. BBB A+ rated. On-site within 200 miles of High Point. Call (336) 886-3282.

What Exactly Is Due on July 17, 2026?

Three CVEs added to the CISA KEV catalog on July 14, 2026 carry a July 17 remediation deadline. A fourth (AD FS) is on July 28. All four are actively exploited in the wild.

The three July 17 KEV items:

• CVE-2026-15409 - SonicWall SMA1000 unauthenticated Server-Side Request Forgery (SSRF). CVSS 10.0. Lives in the Appliance Work Place component. An unauthenticated attacker who can reach the appliance over HTTPS can pivot server-side requests through it.
• CVE-2026-15410 - SonicWall SMA1000 post-authentication code injection in the Appliance Management Console. CVSS 7.2 on its own. Chained after CVE-2026-15409, yields unauthenticated remote code execution as administrator.
• CVE-2026-56164 - Microsoft SharePoint Server missing authentication elevation of privilege. On-premises SharePoint (not SharePoint Online). Actively exploited zero-day disclosed in Microsoft's record 622-CVE July 14 Patch Tuesday.

The July 28 companion item:

• CVE-2026-56155 - Microsoft Active Directory Federation Services (AD FS) elevation of privilege. Actively exploited. Longer FCEB timeline because rollback and coordination complexity are higher.

Three concrete facts every NC SMB should treat as confirmed:

• SonicWall's fixes ship in builds 12.4.3-03453 and 12.5.0-02835. Any SMA1000 running an earlier build after July 17 is a documented CISA KEV finding on the appliance's public-facing HTTPS surface.
• SharePoint on-premises is the exposed surface. SharePoint Online (Microsoft 365) customers are not in scope for this specific CVE. If your NC SMB migrated to M365 SharePoint years ago, you inherit the patch for free from Microsoft's cloud operations team; if you still run WSS/MOSS/SharePoint Server 2016/2019/SE on-prem, you own the patch and the window.
• The KEV chain (CVE-2026-15409 + CVE-2026-15410) is a full compromise chain. SonicWall SMA1000 remote-access gateways sit at the internet edge and terminate user VPN sessions with LDAP/SAML federation into your Active Directory. A successful chain is a domain-adjacent foothold, not a stand-alone appliance breach.

Key takeaway: July 17 is not the date "federal agencies patch." It is the date competent threat actors were already patching against, in the sense of already exploiting. If your NC SMB is on the July 17 track today, you are at the tail of the distribution, not the leading edge.

Why Should NC SMBs Track BOD 26-04 If It Doesn't Legally Apply to Them?

BOD 26-04 is CISA's Binding Operational Directive that formalizes the KEV remediation timeline for the Federal Civilian Executive Branch. The specific FCEB deadlines are legally binding on federal agencies, not on your NC SMB. The reason NC SMBs track them anyway is that four downstream requirements have started to enforce them by proxy.

Four downstream reasons the CISA KEV deadline is your deadline:

• Cyber insurance renewal underwriting. 2026 carriers increasingly include "documented patch of CISA KEV items within the FCEB timeline" as a control question on renewal applications. A no-answer or a fudged-answer is a documented material misrepresentation in the event of a claim.
• DFARS 252.204-7012 and CMMC compliance. NC defense contractors owe rapid remediation of KEV items under both the CUI safeguarding standard and any active NIST SP 800-171 assessment. Even with CMMC Phase 2 assessments suspended (July 13, 2026 DoD memo), the underlying controls remain in force.
• PCI DSS 4.0.1 quarterly ASV scanning. ASV vendors mark CISA KEV items as high-severity findings. Merchants who ignore the finding fail the quarterly scan and can lose card-brand acceptance.
• HHS OCR HIPAA Risk Management enforcement. July 2026 OCR guidance explicitly cites CISA KEV items as an expected input to Risk Analysis and Risk Management for covered entities and business associates.

For a typical NC SMB with cyber insurance, a handful of retail SKUs paid by card, and an M365 tenant, at least two of the four proxy enforcers apply. For an NC defense-adjacent manufacturer, all four apply.

How Should NC SMBs Patch a SonicWall SMA1000 Under a 72-Hour Window?

The SonicWall SMA1000 chain is the most operationally exposed item in the July 14 KEV set for NC SMBs, because the appliance sits at the internet edge and terminates remote-access VPN. A patch-day workflow that is defensible under insurance scrutiny has six steps.

Six-step SonicWall SMA1000 emergency remediation:

1. Inventory the appliance and its firmware. Confirm current build against SonicWall's advisory. Document the pre-patch state including the running config hash.
2. Announce a maintenance window and prepare rollback. SMA1000 firmware rollback is nontrivial; snapshot the running config, export it offline, and confirm out-of-band console access.
3. Apply the fixed builds (12.4.3-03453 or 12.5.0-02835 per your track). Verify build after reboot. Confirm SSL certificate and portal accessibility.
4. Terminate every existing session and force re-authentication. Any session established before the patch is potentially attacker-hijacked. This is not optional.
5. Rotate every credential the appliance stored. Local admin, LDAP bind service account, SAML signing keys where under your control, and any pre-shared keys for IPsec fallback.
6. Compromise hunt across the LAN. Review Active Directory authentication logs, endpoint EDR data, and outbound firewall logs from the last 14 days for indicators of successful lateral movement. If the appliance was internet-reachable during the pre-patch window, treat this as required, not optional.

Cost for a typical NC SMB with a single SMA1000 pair and 50-300 users: $6,000-$14,000 for the full six-step emergency engagement.

How Should NC SMBs Patch On-Premises SharePoint and AD FS?

The SharePoint on-prem and AD FS items are lower urgency than the SonicWall chain but higher blast radius if exploited, because both sit inside the trust boundary rather than at the edge.

Comparison: The four July 14 KEV items ranked by NC SMB blast radius.

SharePoint on-premises 72-hour workflow:

• Apply the Microsoft security update to every on-prem SharePoint server in the farm. Verify farm health after each server. Document the patch time-stamp for cyber-insurance attestation.
• Review IIS logs and SharePoint ULS logs for the 30 days pre-patch for indicators of the CVE-2026-56164 exploitation pattern.
• Rotate the SharePoint farm account and any service accounts SharePoint uses to access downstream systems.

AD FS 14-day workflow (July 28 deadline):

• Schedule the update in a maintenance window that accommodates federated-relying-party validation. AD FS updates can break SAML integrations with M365, Salesforce, ServiceNow, and any custom SP.
• Coordinate with every application team owning a federated relying party before the change.
• Validate every federation pattern post-patch: form-based sign-in, WS-Federation, SAML 2.0, and OAuth 2.0.

What Does the Attestation Packet Look Like for Cyber Insurance?

The evidence packet is what turns a completed patch into a defensible one. The packet has six components, delivered as a single PDF or SharePoint document set with a stable filename.

PDC's six-component KEV attestation packet:

1. Asset inventory. Every appliance, server, and system in scope for the CVE, with firmware/build/version pre-patch and post-patch.
2. Change window record. Date, time, duration, personnel, and change-management ticket ID.
3. Verification evidence. Screenshots or CLI output demonstrating the fixed build is installed and running.
4. Credential rotation record. Timestamped list of credentials rotated, without the credentials themselves.
5. Compromise-hunt findings. Log-review summary, EDR alert summary, and any indicators-of-compromise checked (present or absent).
6. Executive sign-off. Signed by the accountable officer (typically the president, controller, or MSP account manager on their behalf).

This packet is what a broker or carrier requests when either an underwriter is renewing your policy or a claims adjuster is deciding whether to pay a subsequent unrelated claim. The absence of this packet, in 2026, is the difference between "coverage preserved" and "material misrepresentation cited, claim reduced or denied."

Explore PDC's cybersecurity services - Managed IT services

How Does Preferred Data Handle KEV Emergency Windows for NC SMBs?

Preferred Data Corporation has run KEV-cadence emergency windows across NC SMB clients continuously since CISA's first BOD introduced the FCEB-timeline model. Our program is a four-layer deliverable.

PDC's four-layer KEV emergency program:

1. Same-week patch application. SonicWall, Microsoft, Adobe, Cisco, Fortinet, Palo Alto, Ivanti - every mainstream vendor covered by a documented emergency runbook.
2. Same-week credential rotation. Every credential the vulnerable appliance or server stored, refreshed on the change window.
3. Two-week compromise hunt. Log review, EDR sweep, Active Directory authentication review, and outbound firewall analysis with an itemized findings report.
4. Cyber-insurance attestation packet. The six-component packet, delivered in a portable format, retained for the seven-year insurance-notification window.

Cost for a typical 40-100 person NC SMB with a SonicWall SMA1000 and on-prem SharePoint: $10,000-$18,000 for a full July 17 emergency engagement, or bundled into a monthly managed-security retainer starting at $3,500/month.

Frequently Asked Questions

What is the CISA KEV catalog and why is the July 17 deadline important?

The CISA Known Exploited Vulnerabilities catalog is a curated list of CVEs that CISA has documented as actively exploited in the wild. FCEB agencies must remediate each item by the assigned deadline under Binding Operational Directive 26-04. The July 17, 2026 deadline covers SonicWall SMA1000 CVE-2026-15409, CVE-2026-15410, and Microsoft SharePoint CVE-2026-56164. NC SMBs increasingly track the same deadlines because cyber insurance, DFARS/CMMC, PCI, and HIPAA all reference KEV in their controls.

Do NC SMBs legally have to patch by July 17?

The BOD 26-04 deadline is legally binding on federal civilian agencies, not on NC SMBs directly. However, 2026 cyber-insurance underwriting, DFARS 252.204-7012 for defense contractors, PCI DSS 4.0.1 for card-taking merchants, and HHS OCR guidance for HIPAA covered entities all reference CISA KEV as expected remediation cadence. Missing the deadline is documentable material risk under multiple regulatory and contractual regimes.

If we already migrated to SharePoint Online, are we exposed?

No. CVE-2026-56164 affects on-premises SharePoint Server installations. SharePoint Online (part of Microsoft 365) is patched by Microsoft on the cloud operations schedule. If your NC SMB moved to SharePoint Online years ago, this specific CVE does not apply. Confirm your exact SharePoint deployment with your MSP before assuming you are out of scope.

What if we run a different SonicWall product but not SMA1000?

The July 14 SonicWall advisory is scoped to the SMA1000 series. SonicWall TZ, NSa, NSv, and SMA100 are not in scope for CVE-2026-15409 or CVE-2026-15410. They remain under normal SonicWall PSIRT cadence. Confirm your exact appliance model with your MSP before assuming you are out of scope.

Can PDC apply the patches for us if we don't have IT staff?

Yes. Preferred Data runs KEV-cadence emergency engagements for NC SMBs who lack in-house IT depth. A typical engagement - assessment, change window, application, verification, credential rotation, hunt, and attestation packet - completes inside a two-week window at $10,000-$18,000 all-in for a small footprint.

What does our cyber insurance broker expect to see?

The six-component attestation packet: asset inventory (pre and post), change window record, verification evidence, credential rotation record, compromise-hunt findings, and executive sign-off. Delivered in a portable format that can be attached to the renewal application or a claim submission without editing.

How do we avoid this being an emergency every month?

Move to a managed-security cadence where KEV-listed items are automatically tracked, patched within FCEB timelines, and attested inside a monthly report. The 2026 operating model for edge appliances is monthly-minimum baseline patching plus same-week emergency patching for any KEV addition. Preferred Data operates this cadence for NC SMB clients as a standing service.

Related Resources

• Cybersecurity Services for NC Small Businesses
• Managed IT Services
• Network Services
• Contact PDC - request a KEV-cadence emergency patch engagement