This is the NeoShield daily threat briefing for 2026-07-16, summarizing the most significant cybersecurity developments observed across official and reputable public sources, with defensive guidance for each. Use it to prioritize patching, tune detections, and brief your team.

Today's signals, ranked by severity:

- [CRITICAL] CISA orders feds to patch actively exploited Oracle flaw by Saturday (BleepingComputer). A critical vulnerability in Oracle E-Business Suite is being actively exploited in the wild, prompting CISA to mandate federal agencies patch by an emergency Saturday deadline. Organizations running Oracle E-Business Suite financial applica Defensive action: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

- [CRITICAL] Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands (The Hacker News). SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting Secure Mobile Access (SMA) 1000 series appliances, one of which could be exploited to achieve arbitrary command execution. The vulnerabilities are listed Defensive action: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

- [CRITICAL] CVE-2026-46817 · Oracle E-Business Suite (CISA KEV). Oracle E-Business Suite contains an Improper Privilege Management vulnerability that is actively being exploited in the wild, allowing attackers to escalate privileges within the application. Immediate patching and access control review are Defensive action: Confirm exposure, apply vendor patches, add temporary WAF/IPS rules, and run post-patch vulnerability validation.

- [CRITICAL] SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now (BleepingComputer). SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates. [...] Defensive action: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

- [CRITICAL] Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack (The Hacker News). Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already exploiting. The release covers 622 of Microsoft's own CVEs by its Security Update Guide count, more than trip Defensive action: Apply security updates, prioritize domain controllers and internet-facing Windows services, then monitor authentication anomalies.

- [CRITICAL] CISA Adds Four Known Exploited Vulnerabilities to Catalog (CISA News). CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CVE-2026-15410 Son Defensive action: Confirm exposure, apply vendor patches, add temporary WAF/IPS rules, and run post-patch vulnerability validation.

Defensive priorities for today: confirm exposure of any internet-facing systems named above and apply vendor patches first; for items in the CISA Known Exploited Vulnerabilities catalog, treat remediation as urgent because active exploitation is confirmed. Validate that logging and EDR coverage extend to the affected technologies, add temporary WAF/IPS rules where a patch is not yet available, enforce phishing-resistant MFA, and verify that backups are recent, tested, and isolated.

Hunt and detect: review authentication logs for anomalous logins and impossible travel, watch for new scheduled tasks, services, or inbox rules, and alert on outbound connections to newly registered or low-reputation infrastructure. Map relevant activity to MITRE ATT&CK so detections and response steps stay aligned with how these threats actually operate.

This briefing is informational and is not a substitute for the official vendor and government advisories linked from the source feeds.