Your VPN Is the Front Door: Edge Device Exploitation Behind 2026 Ransomware Attacks
By ScruteXPublished
Most security programmes count the VPN as a control. In 2026, ransomware operators treated it as an entry point. They reached internal networks through VPN gateways and firewalls using new authentication flaws, vulnerabilities fixed years earlier, and stolen passwords. In several cases the device had already been patched by the time anyone checked, and patch status alone could not show whether an attacker had been in.
Edge device security is the work of finding, hardening and monitoring the internet-facing equipment that controls access to your network, and of proving afterwards that nobody used it against you. This article sets out why edge devices stay exposed, how to prioritise fixes using the right evidence, and what to investigate after you patch.
Key takeaways
- Exploitation of vulnerabilities was the most common known initial access vector , at 31% of breaches.
- Most edge risk traces to four gaps: forgotten portals, exposed management interfaces, misleading prioritisation signals, and credentials that outlive the patch.
- "Publicly known", "exploited", "used by ransomware", "likely to be exploited" and "exploited here" are different claims. Prioritisation goes wrong when teams blur them.
- Patching a once-vulnerable edge device should open a review of the sessions it accepted while exposed.
What is edge device exploitation?
Edge device exploitation is an attack on the equipment between an organisation's internal network and the internet. That includes VPN gateways, firewalls, SSL VPN portals, remote access appliances and their management interfaces. The attacker abuses a flaw, a weak configuration or a stolen login on the device. The result is a session that the internal network treats as a legitimate remote user.
"Edge device" means different things in other fields, where it can describe IoT sensors or edge computing nodes. In ransomware investigations it almost always means the remote access stack.
Three properties make these devices attractive. They must be reachable from the internet. Most cannot run endpoint detection agents. And their logs often stay on the appliance, where they can roll over or be cleared. A successful attacker can look like an employee working from home.
How big is the edge exposure problem?
A two-month ASD research project found 17.9 million internet-visible devices in Australia, and it identified 212,000 of them as edge devices (ASD). Each one is a login page or service that anyone can test.
VPN access also has a resale market. Of 876 initial access broker offers examined over four years, 44% were for VPN access, with remote desktop access close behind. A broker never has to deploy ransomware. Selling working access to a group that will is enough.
Why do edge devices stay exposed?
When we trace 2026 edge intrusions back to a root cause, four gaps recur. Each one can be measured.
1. Forgotten and unintended portals
You cannot patch a VPN portal that is missing from your asset register. Edge devices pile up through branch offices, acquisitions, pilot projects and vendor-managed sites. Joint guidance from the Five Eyes agencies starts here: identify every edge device and replace those past end of life (joint guidance
Known devices can be exposed by accident too. In one recurring misconfiguration, GlobalProtect profiles mapped to HTTP or HTTPS services on firewall management interfaces exposed those interfaces to the internet on ports 4443 and 3879. Administrators often did not know. The vendor's test is simple: from a browser outside your network, try an HTTPS connection to the management IP on those ports (
Lesson: build the edge inventory from the outside in, then reconcile it with internal records.
2. Management interfaces with weak authentication
Some edge compromises need no vulnerability. Amazon's threat intelligence team reported that a financially motivated actor compromised more than 600 FortiGate devices in 55 countries in early 2026. The actor exploited no vulnerability. Exposed management ports and weak single-factor passwords were enough (AWS). From those devices, the actor extracted configurations containing administrator credentials, SSL VPN passwords and network topology.
Lesson: an internet-reachable management interface with password-only login needs attention whatever its patch status.
3. Prioritising on incomplete signals
We pulled exploitation context for eight edge and backup CVEs that appear in 2026 ransomware reporting and advisories. The data comes from ScruteX threat intelligence as of 26 October 2026, drawing on CISA KEV and FIRST EPSS. EPSS estimates the probability that a CVE sees exploitation activity in the next 30 days. The percentile shows where that score sits against every other scored CVE.
| CVE | Product | CVSS (see note) | Added to KEV | KEV ransomware use | EPSS percentile |
|---|---|---|---|---|---|
| CVE-2026-0257 | PAN-OS GlobalProtect | 7.8 | 29 May 2026 | Known | 99.89 |
| CVE-2026-35616 | FortiClient EMS | 9.8 | 6 Apr 2026 | Not flagged | 99.85 |
| CVE-2025-64446 | FortiWeb | 9.8 | 14 Nov 2025 | Not flagged | 99.82 |
| CVE-2024-40711 | Veeam Backup & Replication | 9.8 | 17 Oct 2024 | Known | 99.80 |
| CVE-2023-27532 | Veeam Backup & Replication | 7.5 | 22 Aug 2023 | Known | 99.63 |
| CVE-2020-3259 | Cisco ASA / FTD | 7.5 | 15 Feb 2024 | Known | 99.42 |
| CVE-2023-20269 | Cisco ASA / FTD remote access VPN | 5.0 | 13 Sep 2023 | Known | 97.95 |
| CVE-2024-40766 | SonicWall SonicOS | 9.8 | 9 Sep 2024 | Known | 97.23 |
Note: CVSS values are as recorded by ScruteX and come from mixed sources. CVE-2026-0257 shows the vendor's CVSS v4.0 score. CVE-2023-20269 is scored 5.0 by Cisco and 9.1 by NVD (both CVSS 3.1). CVE-2024-40766 is reported as 9.3 by SonicWall and 9.8 in the ScruteX record. EPSS values change daily.
Three lessons follow from the table.
The scoring source changes the queue. For CVE-2023-20269, Cisco's score is medium and NVD's is critical (NVD). A team that ingests vendor scores could defer a flaw that appears in an October 2026 joint government ransomware advisory.
KEV confirms exploitation, but late. CVE-2020-3259 was published in 2020 and entered KEV in February 2024.
A blank ransomware field means "not reported", not "not used". CVE-2026-35616 is not flagged, yet ScruteX threat intelligence links it to reporting on INC and The Gentlemen affiliates. Treat a blank field as unknown.
4. Credentials that outlive the patch
A patch closes a vulnerability. It does not invalidate credentials attackers may have obtained by exploiting it. Since July 2025, ransomware operators have reportedly accessed SSL VPNs using credentials believed to have been obtained through CVE-2024-40766, including accounts protected by one-time password (OTP) multifactor authentication (MFA) (incident analysis). Response guidance included resetting local SSL VPN passwords, particularly for accounts migrated from older hardware
Lesson: treat leaked credentials for VPN-capable accounts as an edge finding.
How does the device lifecycle create exposure?
Edge devices often outlive the decisions that configured them. Three lifecycle stages create exposure that patching does not touch.
End of life. Once a product line loses vendor support, new flaws stay unfixed. Some older firewall generations reached end of life on 16 April 2026 (SANS ISC). Vendor advisories show what that means in practice. The CVE-2026-0257 advisory lists no fix for older unsupported PAN-OS versions and tells those customers to move to a supported fixed release . Keep support end dates next to your edge inventory. Treat an unsupported internet-facing device as a standing high-priority finding until you replace it.
Migration. Hardware refreshes can carry forward legacy configurations and accounts. During a 2025 ransomware campaign, response guidance highlighted local SSL VPN accounts migrated from older to newer firewall hardware as candidates for password resets. Investigations also identified service and directory-integration accounts with VPN access they did not need. Every migration plan should include an account review: remove accounts nobody owns, reset the rest, and confirm that service accounts cannot open VPN sessions.
Configuration drift. A change made for one purpose can open exposure elsewhere. The GlobalProtect profile mapped to a management interface (gap 1) is one example. Compare each device's running configuration with an approved baseline after every change window. Then confirm from outside your network that management services are still unreachable.
Case study: what CVE-2026-0257 teaches
We use one case because it touches all four gaps. CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS that lets an attacker establish an unauthorised VPN connection. It only affects firewalls where authentication override cookies are enabled and a specific certificate configuration exists . An internet-facing GlobalProtect portal is therefore not automatically vulnerable, and configuration belongs in the risk decision. On affected devices, the vendor confirms attackers use the flaw to get past MFA and open a VPN session.
| Date | Event | Evidence level |
|---|---|---|
| 13 May 2026 | Advisory published. Fixed releases for different branches ship between 14 and 28 May | Vendor-confirmed |
| 17 May 2026 | Rapid7 MDR first sees likely exploitation in a customer environment. A second wave hits several customers on 21 May | Reported (Rapid7, published 29 May) |
| 29 May 2026 | Rapid7 publishes its findings and a proof of concept. The vendor updates exploitation status and raises severity. CISA adds the flaw to KEV with a 1 June due date | Confirmed |
| June 2026 | Vendor reports exploitation by an unidentified actor, with no post-access activity identified at that point | Vendor-reported |
| June 2026 | Several intrusions traced to this flaw end in Qilin ransomware | Confirmed by incident responders (Arctic Wolf) |
| 19 to 20 Oct 2026 | Vendor names Qilin and INC operators and describes post-access activity | Vendor-reported |
KEV date note: CISA catalog data, Rapid7 and press reporting give 29 May. The vendor's threat brief states 13 May. We use 29 May.
The case carries four lessons for defenders.
The fix arrived in stages, so mitigations mattered. Exploitation was first seen four days after the advisory, but some fixed releases did not ship until 28 May. Teams waiting for their branch needed the vendor's interim mitigations: a dedicated certificate for Authentication Override cookies, or turning Authentication Override off.
The severity rating moved. The vendor first scored the flaw 4.7 (medium) under CVSS v4.0. On 29 May, with exploitation confirmed and a public proof of concept out, the score rose to 7.8 (high). A severity reading taken on day one was stale within two weeks.
Early observations were incomplete. In June, the vendor had identified no post-access activity. By October, it described a typical sequence: reconnaissance with remote monitoring and management tools, lateral movement over RDP and SMB, then staged tools for credential harvesting, data theft and ransomware. Some attackers also chained the access with the Veeam flaw CVE-2023-27532. A clean early assessment did not mean a clean outcome.
Attackers reached the virtualisation layer. In one case, attackers moved from the VPN gateway to vCenter, disabled ESXi security controls and dumped credentials offline from a domain controller's virtual disk, bypassing in-guest EDR. The vendor's brief does not attribute this case to a named group.
Government reporting fits the same pattern. The October joint advisory on SafePay links the group to at least 600 victims since August 2024 and lists five CVEs disclosed between 2020 and 2024 (CISA AA26-293A). Two of those CVEs affect Veeam Backup & Replication. The advisory also notes that SafePay may delete shadow copies and reset backup NAS devices. The backup server belongs on the edge patch list.
How the case maps to MITRE ATT&CK
| Tactic | Technique | Seen in the 2026 reporting |
|---|---|---|
| Initial Access | T1190 Exploit Public-Facing Application | CVE-2026-0257, CVE-2026-35616, CVE-2024-40766 |
| Initial Access | T1133 External Remote Services | GlobalProtect and SonicWall SSL VPN sessions |
| Initial Access | T1078 Valid Accounts | Stolen or migrated VPN, LDAP and service accounts |
| Lateral Movement | T1021.001 Remote Desktop Protocol | Qilin and INC intrusions |
| Defense Evasion | T1562.001 Disable or Modify Tools | ESXi security controls turned off |
| Credential Access | T1003 OS Credential Dumping | Domain controller virtual disk read offline |
| Impact | T1490 Inhibit System Recovery | SafePay shadow copy and backup NAS resets |
| Impact | T1486 Data Encrypted for Impact | Qilin, INC, SafePay, Akira |
Technique mapping by ScruteX Threat Research, based on the cited reporting.
How should you prioritise edge vulnerabilities?
Start by keeping the evidence types separate. Each signal answers a different question.
| Signal | What it tells you | What it does not tell you |
|---|---|---|
| Public CVE and advisory | A flaw exists in named versions and configurations | Whether anyone is using it |
| KEV listing or vendor-confirmed exploitation | Attackers have used it somewhere | Whether your device was targeted |
| KEV "known ransomware use" | Ransomware operators have used it | That a blank field means safe |
| EPSS | Predicted likelihood of exploitation activity in the next 30 days | Whether exploitation already happened, or whether stolen credentials are being reused |
| CVSS | Technical severity under the scorer's assumptions | Exploitation activity or your exposure; scores also differ by source |
| Indicators in your own logs | Possible compromise of your environment | Anything certain until investigated |
Then add context that no external score contains. Is the device internet-facing? Does your configuration match the affected conditions? What does the device front: a test lab or the whole corporate network? Do compensating controls apply, such as source IP restrictions or a vendor mitigation already in place?
The tiers below are a starting point, not a formula. Adjust them for your environment and change process.
| Starting priority | Typical conditions | Typical response |
|---|---|---|
| Urgent | Internet-facing, affected configuration, confirmed exploitation, no mitigation | Patch or mitigate as soon as change control allows; start an exposure window review |
| Urgent | Management interface reachable from the internet with password-only login | Restrict access; rotate administrator credentials |
| High | Leaked credentials for accounts with VPN access | Reset; review VPN logs for use of those accounts |
| High | Internet-facing, high EPSS, no confirmed exploitation yet | Accelerated patching; watch for exploitation reports |
| Planned | Not internet-facing, no exploitation evidence | Standard cycle |
Two adjustments apply in most environments. An edge device past vendor support stays high until replaced, because fixes will not come. And a confirmed-exploited flaw on a device with strong compensating controls may reasonably drop a tier, provided you record why.
What should you investigate after patching?
Patching answers "can someone still use this flaw?" It does not answer "did someone already use it?" The remediation gap is also wide: only 26% of critical KEV vulnerabilities were fully remediated in 2025.. For each edge device that ran an affected version in an affected configuration, work through the steps below.
Define the exposure window
Start at the earliest of disclosure, first reported exploitation or proof-of-concept release. End when the patch or mitigation took effect. For zero-days, start from the earliest exploitation date the vendor reports, which may come before disclosure. For CVE-2026-0257, the vendor also tells defenders to hunt from the proof-of-concept release on 29 May, because public code brings a second wave of attackers.
Which VPN log fields should you pull?
| Field | Why it matters |
|---|---|
| Timestamp and session duration | Sessions at odd hours, or lasting days, stand out. You need both to build a timeline. |
| Username and authentication method | Shows which accounts were used and how they authenticated. CVE-2026-0257 abused authentication override cookies, so cookie-based logins in the window deserve a closer look. |
| Source IP address | Hosting providers and commercial VPN ranges are leads, not proof. Staff use commercial VPNs too. |
| Assigned internal IP | Lets you follow the session into internal logs for RDP, SMB, vCenter and the domain controllers. |
| Client hostname, host ID and OS version | Exploit code often hard-codes these values. |
| Connection result | A successful connection matters more than a failed probe. |
The CVE-2026-0257 threat brief shows these fields in use. It tells defenders to search GlobalProtect logs for successful gateway-connected events with suspicious host IDs or device names. It also lists hard-coded client values from public exploit code, including the endpoint OS version string and an empty user domain field (vendor threat brief). Pull directory and identity provider authentication logs for the same window, so you can match VPN sessions to account activity.
What if the logs are gone?
Local retention on an appliance is usually limited by its storage and log volume, not by a set number of days, so a busy gateway can overwrite the window you need. Check the real retention on each device now, before an incident forces the question. Joint Five Eyes guidance treats forensic visibility on edge devices as a baseline requirement, both before and after a compromise (joint guidance). In India, the CERT-In Directions also require covered entities to keep logs of their ICT systems for a rolling 180 days (CERT-In).
If the device logs are gone, record that gap. Then check the systems behind the VPN, such as domain controller, hypervisor and remote management logs, for activity from the VPN address pool. Plan for wider credential rotation, because you can no longer rule accounts out.
How do you scope credential rotation without locking out the business?
Rotate in order of risk instead of resetting everything at once.
- Secrets the device stores. Start with local administrator accounts, service and LDAP bind accounts, and OTP or TOTP secrets. In the SonicWall campaign, researchers advised resetting every credential stored on the firewall, including OTP secrets and LDAP-synced Active Directory accounts used for SSL VPN access (Help Net Security).
- Accounts that connected during the window. Prioritise those behind flagged sessions.
- All VPN users. Do this if logs are missing, or if the review shows the attacker reached the directory.
Stagger resets by user group, warn users before each wave, and staff the helpdesk for MFA re-enrolment. Test every integration that depends on a rotated service account, because these resets are the ones that break production. The patch itself may force a reset too. The CVE-2026-0257 fix regenerates authentication override cookies, so GlobalProtect users must re-authenticate once after the upgrade. For phased upgrades across mixed versions, the vendor documents a temporary compatibility setting, and strict validation must be re-enabled once every portal and gateway is upgraded .
Follow sessions inward and record the outcome
Look for RDP or SMB connections from the VPN address pool, new remote management tools, vCenter logins and new administrator accounts. Document what you checked, what you found and what you could not check. Reporting duties may apply. CERT-In's Directions require covered entities to report listed incidents within six hours of noticing them. NIS2 requires an early warning within 24 hours of becoming aware of a significant incident (NIS2).
Going forward, forward edge logs to central storage, and use phishing-resistant MFA for remote access where supported. Keep hypervisor management out of reach of VPN address pools, and isolate backup infrastructure.
What does edge exploitation mean for the business?
For a board, the message fits in two sentences. The device that lets staff work remotely became one of the most common ways ransomware crews got in this year. In 2026 those crews reached the hypervisor, where one compromise can stop every virtual server at once.
Ransomware appeared in 48% of the breaches in the 2026 DBIR , and the CVE-2026-0257 intrusions alone span education, financial services, healthcare, government, manufacturing, utilities and retail . The cost does not stop at the company. When a hospital's virtual servers go dark, patients wait for treatment. When a bank's data leaks in a double extortion attack, account holders get fraud calls that quote their real details. Edge security protects those people too, which is why it belongs in the resilience plan and not only in the IT backlog.
Am I exposed?
Check these yourself, today. None of them needs ScruteX.
- ☐ Is your list of internet-facing VPN, firewall and remote access devices checked against an external view?
- ☐ Is any management interface reachable from the internet, including ports 4443 and 3879 on PAN-OS firewalls?
- ☐ Do you run an affected version and configuration of any product in the CVE table?
- ☐ Is any internet-facing edge device past vendor support?
- ☐ Does any VPN or RDP entry point accept a password alone?
- ☐ Have credentials for VPN-capable accounts appeared in leak sources in the last 95 days?
- ☐ Have you reviewed exposure-window sessions on every edge device you patched this year?
Any answer that worries you, and any "not sure", means you should start with the inventory and exposure window steps above.
What ScruteX finds here
Incident responders and authenticated vulnerability scanners do work an outside view cannot. Responders see inside victim networks, and a credentialed scanner reads firmware versions more precisely than any external probe. Large teams that run a dedicated tool for each job, with staff to correlate them, are well served by that model. The gap shows up in smaller teams, where the exposed portal sits in one console and the leaked VPN password sits in another. SafePay, Akira and the 2026 broker campaigns all combined a reachable device with a valid credential, so we treat that correlation as the unit of work.
Starting from your domain, ScruteX discovers internet-facing assets and services, including VPN portals and firewall login pages missing from internal records. It matches what it finds against CVEs and ranks them by real-world exploitability, using KEV status, EPSS and reported threat actors instead of CVSS alone. It flags credentials tied to your domains that appear in dark web sources, infostealer logs and breach databases, which covers the "leaked credentials for VPN accounts" row in the priority table. Results reach your team through the dashboard, the REST API or webhooks.
External visibility has limits. ScruteX cannot confirm whether an attacker holds a session inside your network. It also does not read device configuration, such as whether Authentication Override is enabled. Those questions need your VPN logs, internal telemetry and, where warranted, an incident response team.
What that looks like
This is the ScruteX threat context view for CVE-2026-0257 on 26 October 2026, the same data behind the table above:
When a portal on your domain matches this CVE, the finding carries this context, so the team can see why it outranks a higher-CVSS flaw on an internal server.
Check your edge exposure
Is any VPN or firewall portal on your domain exposed to the CVEs in this post? Enter your domain at scrutex.ai and see what an attacker sees. Agentless, no credit card.
Where to go next
- If you are not sure every portal is on your list: Vulnerability Insights covers continuous external discovery and exploitability-based prioritisation.
- If stolen VPN logins worry you more than firmware: Data Exposure Insights covers infostealer logs, paste sites and breach databases.
- To go deeper on discovery method: EASM best practices for 2026 explains how to build and maintain an outside-in asset inventory.
- If you suspect the problem is credentials, not code: How to find leaked credentials on the dark web walks through the sources and the checks.
FAQ
What is edge device exploitation?
It is an attack on devices at a network's boundary, such as VPN gateways and firewalls. The attacker uses a flaw, weak setting or stolen login to gain a trusted session inside the network.
Is every internet-facing GlobalProtect portal vulnerable to CVE-2026-0257?
No. The vendor says exposure requires authentication override cookies and a specific certificate configuration. Check your configuration and version against the advisory.
Does MFA stop VPN attacks?
MFA stops password spraying against accounts that enforce it. It does not stop authentication bypass flaws such as CVE-2026-0257, and it can fail if attackers hold stolen OTP secrets.
How should we prioritise edge vulnerabilities?
Combine internet exposure, affected configuration and confirmed exploitation. Then weigh EPSS, business criticality and compensating controls. Use CVSS as one input, and check which source produced the score.
How long should we keep VPN logs?
Long enough to cover a realistic exposure window, and at least as long as any regulation that applies to you. Covered entities in India, for example, must keep ICT system logs for a rolling 180 days under the CERT-In Directions. Check what each appliance actually retains, and forward logs to central storage.
We patched. Are we safe?
Not necessarily. Review sessions from the exposure window, and rotate stored credentials in order of risk where the evidence or vendor guidance supports it.
Which CVEs are in the SafePay advisory AA26-293A?
The advisory lists CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. They affect Cisco ASA and FTD, Veeam Backup & Replication and SonicWall SonicOS.