Firewall and VPN security: why attackers now go after the devices meant to keep them out

They're always reachable, they sit on the boundary, and they often hold the keys to the rest of the network. A VPN usually checks logins against Active Directory, so taking one over can give an attacker credentials as well as a way in. Most can't run EDR, so a compromise can go unnoticed for weeks.

ASD's February 2025 guidance, Mitigation Strategies for Edge Devices, describes these as devices that "act as boundaries between organizations' internal enterprise networks and the Internet". Mandiant's M-Trends 2026 says groups it tracks as UNC6201 and UNC5807 "deliberately target edge and core network devices, such as virtual private networks (VPNs) and routers, that typically lack standard endpoint detection and response (EDR) telemetry".

Finding vulnerable devices is now largely automated. In the Palo Alto campaign covered in our PHP2Shell brief, researchers at Dream found the attackers used AI tools to identify about 19,000 internet-facing Palo Alto firewalls, then gained root access on 25 firewall and management servers. ASD's Annual Cyber Threat Report 2025-26 expects more of this: "AI is reducing the expertise and effort required to identify and exploit vulnerabilities, likely accelerating Time to Exploit".

Between 13 and 31 October, five issues from four vendors were confirmed under attack or flagged as critical. The table shows where each stood as at 2 November 2026. Check the vendor's advisory for the latest fixed versions before you act.

Not for devices that face the internet. ASD's Annual Cyber Threat Report 2025-26 says "most vulnerability exploitation occurs within two weeks, with some CVEs successfully exploited within 48 hours of a patch or mitigation advice being released". A monthly cycle can leave an edge device exposed for weeks after attackers have a working exploit.

ASD puts it bluntly: "The gap between vulnerability disclosure and its exploitation has never been narrower. In the past, defenders had months to patch, now they have days, sometimes only hours." The report's executive summary says organisations "must radically speed up patching processes".

The wider data shows how far most organisations are from that. Verizon's 2026 Data Breach Investigations Report found that only 26% of the vulnerabilities on CISA's KEV catalogue were fully fixed in 2025, down from 38% the year before, and the median time to fully fix one rose from 32 to 43 days.

Old flaws don't go away either. In 2025-26, ASD recorded successful exploitation of a vulnerability first identified in 2008.

A practical answer is to run two patch tracks:

• Edge track. Firewalls, VPNs, remote access gateways and anything else reachable from the internet. When a vendor, the ACSC or CISA's KEV catalogue flags a critical or exploited flaw, patch or apply the vendor's workaround within 48 hours. Pre-approve this as a standard emergency change so it doesn't wait for a change board.
• Standard track. Everything else, on your normal cycle.

ASD's advice on getting there: "By understanding vendor patch schedules and regularly scanning for missing patches, organisations can dramatically reduce the time between identifying new vulnerabilities and applying fixes."

Look at what happened before the patch went on. Review the device's logs, configuration and accounts from at least the date the flaw was disclosed, and check the systems the device trusts, especially Active Directory. A fix closes the vulnerability. It doesn't remove an attacker, stolen credentials or a backdoor already in place.

ReliaQuest, which tracked the CVE-2026-0257 attacks, warns that "Patching alone may not remove access established before remediation." Mandiant's M-Trends 2026 puts the median dwell time, the time an attacker is inside before being found, at 14 days.

ASD's own work shows why reporting matters. In August 2025, numerous Australian organisations reported ransomware incidents to ASD. By combining their technical data, ASD linked the attacks to a known SonicWall vulnerability exploited by the Akira ransomware group. Its scans found almost 1,000 potentially vulnerable devices and around 40 potentially vulnerable Australian organisations, many of them critical infrastructure. ASD notified them and published an alert, and afterwards saw fewer incidents using similar techniques.

For devices that can't run EDR, ASD's advice is to watch the traffic: "All organisations should map and baseline their edge device traffic, especially VPN remote access connections".

1. List every internet-facing device. Firewalls, VPN gateways, remote access portals and anything with a login page. Record the model, software version, support end date and who patches it. Check from the outside as well: an external scan often finds devices nobody listed.
2. Take management interfaces off the internet. Allow admin access only from a management network or jump host. On PAN-OS, also check for management profiles attached to dataplane interfaces.
3. Check versions against this month's advisories. Ivanti Connect Secure on 25.1.1.3 or 22.8R2.6 or later. PAN-OS on the fixed release for your version. Cisco ASA and FTD on a fixed release, and every tunnel group (including DefaultWEBVPNGroup) checked for secondary authentication. Fortinet upgraded before 10 November.
4. Hunt before you close the ticket. Review logs from before the patch for new or changed admin accounts, configuration changes, unfamiliar VPN sessions or source addresses, unexpected files and outbound connections from the device itself. Use the vendor's integrity checking tool where one exists.
5. If you find anything, treat the device's credentials as exposed. Reset the service accounts the device uses to query Active Directory, local admin accounts and any VPN accounts that show misuse. Check Active Directory for new accounts and group membership changes. If you run Ivanti Connect Secure, consider whether BitLocker recovery keys need rotating.
6. Send edge device logs to your SIEM and alert on them. They're often the only evidence you'll have. ASD's edge device guidance lists "Centralize monitoring for threat detection" as one of its strategies.
7. Protect what sits behind the VPN, especially virtualisation. Use separate admin accounts and MFA for vCenter and ESXi, keep their management networks apart from user networks, and make sure Veeam is patched for CVE-2023-27532.
8. Use phishing-resistant MFA, and don't rely on it alone. CVE-2026-0257 shows that a flaw in the VPN itself can skip MFA entirely.
9. Replace end-of-support edge devices. A device the vendor no longer supports won't get fixes. ASD says "The most effective method to mitigate the risk posed by legacy tech is to replace it before it becomes unsupported."
10. Set up the 48-hour edge track. Subscribe to ACSC alerts and CISA's KEV catalogue, name an owner for each edge device, and pre-approve emergency changes.

• Which of our devices are reachable from the internet, and how do you know the list is complete?
• How long did our last three critical firewall or VPN patches take, from the vendor's advisory to installation?
• When you patch an exploited flaw on an edge device, do you also check whether it was compromised beforehand? What do you look at?
• Are our firewall and VPN logs going to a SIEM, and who reviews the alerts, including after hours?
• Can anyone reach a management interface from the internet?
• Which of our edge devices reach end of support in the next 18 months, and what's the plan to replace them?

If you'd like a second opinion on your firewalls and VPNs, talk to one of our security specialists. A penetration test shows what's reachable from the internet, what's out of date, and what an attacker could reach from there.

1. Australian Signals Directorate, Annual Cyber Threat Report 2025-26, October 2026 (pp. 1, 13, 19, 22, 38, 44, 48).
2. Australian Signals Directorate (with partner agencies), Mitigation Strategies for Edge Devices: Executive Guidance, February 2025.
3. Australian Signals Directorate (with partner agencies), Mitigation Strategies for Edge Devices: Practitioner Guidance, February 2025.
4. Verizon, 2026 Data Breach Investigations Report.
5. Mandiant (Google Cloud), M-Trends 2026.
6. The Hacker News, Cisco patches actively exploited ASA flaw, 29 October 2026.
7. The Hacker News, Attackers chain three Ivanti Connect Secure flaws, 31 October 2026.
8. The Hacker News, Attackers exploit PHP2Shell flaws in Palo Alto firewalls, 29 October 2026 (updated 30 October).
9. Cybersecurity Dive, Palo Alto Networks firewalls compromised in chained PHP2Shell attacks, 30 October 2026.
10. Unit 42, Active Exploitation of May 2026 PAN-OS CVE-2026-0257, updated 20 October 2026.
11. Infosecurity Magazine, Months-old Palo Alto VPN vulnerability remains a target for ransomware groups (ReliaQuest), 12 October 2026.
12. Cyber Daily, ACSC warns of critical vulnerabilities in FortiOS, FortiManager, FortiAnalyzer and FortiMail, 26 October 2026.
13. SecurityWeek, Organizations urged to replace discontinued edge devices (CISA, FBI and NCSC alert), 7 February 2026.
14. The Register, Dream's research on PHP2Shell attacks against Palo Alto firewalls, 29 October 2026.
15. The Hacker News, PAN-OS GlobalProtect authentication bypass (CVE-2026-0257), 30 May 2026.