The gatekeeper is the target: why VPN gateways keep letting attackers in

Two gateways, one week

On 28 October 2026, Cisco disclosed an actively exploited flaw in the remote-access VPN of its Secure Firewall ASA and Threat Defense software. An unauthenticated attacker can force the firewall to reload, cutting remote access. A successful VPN login is not needed, and Cisco lists no workaround, only a mitigation that weakens VPN security (Cisco).

The next day, the US cybersecurity agency CISA added the flaw to its catalogue of known exploited vulnerabilities and gave federal civilian agencies until 1 November to fix it (The Hacker News). On 30 October it added two Ivanti Connect Secure flaws, with deadlines of 2 and 13 November (The Hacker News).

The Ivanti flaws close a story that began on 3 October. Researchers at Volexity found a previously undocumented actor chaining three flaws to gain root on a Connect Secure appliance that was fully patched at the time. The attacker extracted stored credentials, searched the directory for local administrator passwords and BitLocker recovery keys, and trimmed logs to cover its tracks. Ivanti's own integrity checker did not detect the changes (Volexity).

1. 3 October · IvantiExploitation of a fully patched Connect Secure appliance begins. Volexity discloses it on 13 October.
2. 27 October · TeamViewerA fix ships for a flaw that lets a malicious remote host crash, or on some platforms run code on, the computer connecting to it. TeamViewer knows of no attacks (TeamViewer).
3. 28–29 October · CiscoA second exploited firewall VPN flaw since August. CISA sets a deadline of three days.
4. 29–30 October · IvantiThe privilege-escalation fix ships. CISA lists both remaining flaws in the chain as exploited.

Three vendors, one category: the products organisations buy to let trusted people in from outside. None of these flaws needed a stolen password to start. Each one sat in the code that runs before the gateway knows who is calling, which is exactly the part that has to face the internet.

A pattern, not a bad week

The Cisco flaw is not the first of its kind this year. In August, Cisco disclosed CVE-2026-20349, another unauthenticated flaw in the same VPN service that crashed the firewall, and confirmed it was exploited (Canadian Centre for Cyber Security). Singapore's Cyber Security Agency issued its own alert (CSA Singapore).

Before that came the 2025 wave of Cisco firewall flaws. Cisco later disclosed a persistence method on those devices that, in the words of Canada's cyber centre, "remains intact even after upgrading to a patched version". In April 2026, CISA and the UK's NCSC published an analysis of a backdoor used on compromised Cisco firewalls (Canadian Centre for Cyber Security).

The data says the same thing at scale. Verizon's 2025 breach report found edge devices and VPNs behind 22% of breaches that began with an exploited vulnerability, up from 3% a year earlier (SecurityWeek). Mandiant’s 2025 report found that the four most frequently exploited vulnerabilities were all in edge devices (GreyNoise).

The same report found that only about 54% of the edge and VPN vulnerabilities in its data were fully fixed during the year, and the median time to do so was 32 days (SecurityWeek).

Why the gatekeeper is the target

Four properties make a remote-access gateway the best-value target on most networks.

• It must answer strangers. A VPN concentrator exists to accept connections from the internet before it knows who is calling. Its login page is its attack surface, and it cannot be switched off without cutting remote work.
• It holds the keys. The Ivanti attacker left no web shell or conventional malware behind. It used the appliance's own position to harvest directory credentials and recovery keys, the material needed to move deeper (Volexity).
• It is a black box. Mandiant notes that VPNs and routers "typically lack standard endpoint detection and response (EDR) telemetry", and names threat clusters that target them deliberately (Google Threat Intelligence, M-Trends 2026).
• Patching does not close the window. Mandiant estimates the mean time to exploit at minus seven days: exploitation routinely starts before a patch exists. The Ivanti appliance was fully patched when it fell.

A gateway that must answer everyone cannot be hidden from anyone.

Volexity also assessed, with medium confidence, that the Ivanti actor used large language models for exploit development. Whatever the tooling, the economics are plain. One flaw in a widely deployed gateway exposes every organisation that runs it and has not yet patched, or cannot.

What it means for critical operators

Governments and critical operators depend on remote access more than most. Engineers reach substations, pumping stations and remote well sites through it. Vendors maintain control systems through it. Command centres reach field units through it. In our region, much of that traffic crosses a handful of internet-facing gateways.

That concentration turns two kinds of flaw into operational risk. A crash flaw like Cisco's is a denial of service against remote operations: on the wrong night, nobody can reach the sites. A takeover flaw like Ivanti's is worse, because the gateway becomes a launch point into the directory that governs everything else.

Recovery is also heavier than a patch. For a suspected Ivanti compromise, CISA's guidance calls for a factory reset or rebuild, then resetting every account password and revoking and reissuing certificates, API keys and licence-server credentials (The Hacker News). For an operator with hundreds of remote users and vendors, that is days of work. During those days, remote maintenance either stops or runs through improvised channels that are harder still to control.

We argued in Off the map that control systems should not answer the internet. The same logic now applies one layer up, to the device meant to protect them.

Five moves for this quarter

1. 01Treat every gateway as compromised until proven otherwise. For the Cisco and Ivanti products named this week, patch, then run the vendor's and CISA's compromise checks, including memory and network forensics where the integrity tools are known to miss changes.
2. 02Count your front doors. List every internet-facing VPN, remote-desktop and vendor-access service, including the ones a supplier installed. Each one is a separate exposure with its own patch cycle.
3. 03Take credentials off the edge. Gateways should not store reusable directory credentials. Use short-lived, phishing-resistant authentication and rotate anything the gateway has ever held.
4. 04Watch the box that cannot watch itself. Send gateway logs off the device in real time, alert on unexpected reloads and configuration changes, and keep logs longer than 90 days.
5. 05Plan to retire the inbound gateway. Move critical sites to connections that start from inside and leave nothing listening on the internet, so the next gateway flaw has nothing to reach.