←

VPNs, firewalls, gateways: when the box that protects you becomes the way in

LuksMentis· July 17, 2026 ·16 min read

Illustration: the edge appliance turned entry point for attacks

For twenty years, enterprise security architecture rested on a simple picture: a perimeter, and boxes to guard it. The firewall filters, the VPN gateway authenticates, the remote access concentrator lets legitimate employees in and no one else. That picture has just been turned inside out. In 2026, the device guarding the door is the door: VPNs, firewalls and gateways now concentrate a record share of intrusions, and the shift is measurable, in the industry's flagship reports as well as in our own data.

Our first-half 2026 threat report flagged it in one sentence: "edge vendors (VPNs, firewalls) remain the preferred way in." This article is the detailed analysis that sentence called for. We went back to our mirror of CISA's Known Exploited Vulnerabilities (KEV) catalog, classified its 1,647 entries by product family, cross-referenced them with ransomware campaigns, and measured how fast the patching window is closing. Three findings stand out: the perimeter weighs far more than its actual size, ransomware concentrates there, and the time available to patch is now counted in days.

2026, the year of the reversal

The break is documented first by the industry's most-watched report. The 2026 edition of Verizon's Data Breach Investigations Report (DBIR) records a first in nineteen years of publication: vulnerability exploitation has overtaken stolen credentials as the leading initial access vector, at 31% of intrusions versus 20% the year before. Credential theft (phishing, infostealers, password reuse) had topped that ranking for as long as it existed. No longer.

And the engine of the shift is clearly identified: edge devices. According to the same DBIR, edge devices and VPNs jumped from 3% to 22% of exploitation-driven breaches in a single year, a sevenfold increase. For several appliance vulnerabilities disclosed in 2025, scanning campaigns started within hours of the advisory, before some vendors had even shipped fixed firmware.

Defense, meanwhile, is not keeping up: the median time to fix a flaw known to be exploited got longer, at 43 days versus 32 a year earlier. The gap between attacker time (hours) and defender time (weeks) is the real subject of this article. What follows unpacks it in three questions: where attackers strike, what for, and how fast.

What the KEV catalog reveals when read by product family

Let us start with the first question: where do they strike? Vendor reports carry a structural bias, each seeing the threat through its own telemetry. So we wanted a neutral, verifiable number, computed on a public source anyone can re-download: CISA's KEV catalog, of which we maintain a continuous mirror. It currently tracks 1,647 vulnerabilities whose active exploitation is confirmed.

We classified every entry, product by product, into four families:

applications and servers: mail systems, CMS, file transfer tools, backup software;
operating systems and endpoints: Windows, browsers, mobile;
the network perimeter: VPNs, firewalls, access gateways, application delivery controllers;
NAS and exposed devices: network storage and connected equipment visible from the Internet.

The KEV catalog by product familySource: LuksMentis mirror of CISA's KEV catalog (1,647 CVEs), per-product classification · luksmentis.com · July 17, 2026

The finding: the perimeter accounts for one actively exploited vulnerability in six (272 entries, 16.5% of the catalog). That may look modest next to applications, which concentrate close to half. It is not, and the explanation lies in each family's actual surface: the world runs tens of thousands of distinct server applications, but only a handful of edge appliance product lines. Weighed against that denominator, the perimeter is by far the most attacked family per product.

The conclusion draws itself: for a category this narrow, a few vendors and a few product lines, to concentrate one sixth of all exploited vulnerabilities, attackers must have invested in it massively. And this ratio describes the stock accumulated since 2021; the recent flow, as we will see, is more skewed still.

One methodological note before going further: in June 2026 our platform widened its CVE ingestion beyond the KEV catalog alone. Every figure in this article is computed exclusively on the strict KEV mirror, precisely to avoid that composition bias. The family classification is editorial and owned as such: mixed vendors (Cisco, Citrix, F5...) are split product by product, a router on the perimeter side, a video-conferencing tool on the application side.

The perimeter, raw material of ransomware

Second question: what do attackers use these perimeter flaws for? The answer that matters to organizations is ransomware, because that is where the damage concentrates. CISA flags in its catalog the vulnerabilities weaponized in ransomware campaigns: one entry in five carries that flag. That average serves as the benchmark for what follows.

Now look at that rate vendor by vendor. This is where the reversal becomes spectacular: at SonicWall, more than one exploited CVE in two has been used for ransomware; nearly one in two at Fortinet; roughly one in three at Ivanti, Palo Alto Networks and Citrix. Every major name in perimeter security sits above the catalog average. At the other end, Apple and Google, despite dozens of exploited CVEs each, sit at zero: their flaws serve espionage and endpoint targeting, not the ransoming of infrastructures.

Share of a vendor's exploited CVEs weaponized by ransomwareSource: LuksMentis mirror of the KEV catalog (1,647 CVEs, 329 tied to ransomware campaigns) · luksmentis.com · July 17, 2026

How to explain it? A compromised gateway provides exactly what a ransomware crew needs: a foothold in the internal network, credentials in transit, and access obtained on day one. Taken together, the five major perimeter security vendors show a 40% weaponization rate, double the catalog average: a vulnerability exploited on a security appliance is twice as likely to end up in a ransomware chain as any random exploited vulnerability. The Cisco case (6%) confirms the reading rather than contradicting it: its KEV stock is dominated by old infrastructure espionage flaws, while its remote access line (ASA, AnyConnect) is very much in the ransomware crosshairs.

Two caveats, to be complete. First, in absolute volume, applications remain the largest family of the ransomware subset: Exchange, file transfer tools of the MOVEit kind, backup software, the surface there is huge. The point is not that the perimeter dominates in volume, but that it is over-represented relative to its size, and that the gap is widening: among entries added to the catalog since 2024, the perimeter carries 29% of the ransomware, versus 19% in the full stock. Modern ransomware no longer comes in through the attachment; it comes in through the gateway.

Second, these ransomware flags are a floor, not a ceiling. GreyNoise researchers showed that in 2025, CISA quietly flipped 59 existing catalog entries to "known ransomware use", with no announcement, through a simple field change in a JSON file. A third of those silent reclassifications target network security appliances: Fortinet SSL-VPN, Ivanti Connect Secure, Palo Alto GlobalProtect, Check Point Security Gateway. Even the official accounting of the threat is catching up with the perimeter after the fact.

Key figures: the perimeter in our KEV mirror
Indicator	Value
Actively exploited CVEs tracked (KEV mirror)	1,647
... of which weaponized by ransomware	329 (20%)
"Network perimeter" entries (VPNs, firewalls, gateways)	272 (16.5%)
Perimeter share of ransomware entries added since 2024	29%
Ransomware rate of the 5 major perimeter security vendors	40% (vs a 20% average)

Source: LuksMentis mirror of CISA's KEV catalog, July 2026 · luksmentis.com · July 17, 2026

Our own group tracking confirms it on the ground: 2026's most talked-about newcomer, The Gentlemen, climbed to second place among the most active actors precisely by industrializing the exploitation of edge devices (FortiOS, SonicWall VPN, Cisco ASA) for initial access (H1 2026 report, ransomware chapter).

The patching window is closing

That leaves the third question, the least visible and perhaps the most important for operational teams: the calendar. For each year, we measured the age of vulnerabilities at the time they entered the KEV catalog, that is, the lag between a flaw's existence (the year of its CVE identifier) and the confirmation of its active exploitation.

Share of CVEs one year old or less when added to the KEV catalogSource: LuksMentis KEV mirror, by year of addition; 2022 = the catalog, created in late 2021, was still catching up on old stock · luksmentis.com · July 17, 2026

Since 2023, the cruising regime has been stable and brutal: the median age of a vulnerability entering the catalog is zero years, and about 77% of entries are one year old or less. In other words, when a flaw gets exploited, it is almost always exploited within the year of its disclosure: the catalog no longer "digs up" old stock, it runs after the flow. (2022 reads differently: the catalog, created in late 2021, was still absorbing its historical backlog, and nearly half of that year's additions were five years old or more. The low starting point is a bootstrap artifact, not a trend.)

Set against the DBIR's defensive number (a 43-day median remediation time, and rising), the conclusion is arithmetic: for edge devices, the window between disclosure and exploitation is shorter than the patch cycle of most organizations. The DBIR documents scanning within hours for 2025 appliance CVEs; on the other side, the fix will wait for the next maintenance window.

This directly extends the thesis of our article on minor vulnerabilities in the AI era: automation collapses the cost of exploitation, and therefore the timeline too. An edge appliance is the logical endpoint of that economy: an identical target across tens of thousands of organizations, enumerable through an Internet scan, exploitable with a single script. When exploitation costs a few dollars and parallelizes, the exposed, standardized appliance is the best return on the market.

Why the security appliance is an ideal target

The paradox is only apparent. From the attacker's point of view, the perimeter security appliance combines everything one could wish for in a target:

It is exposed by design. A VPN exists to be reachable from the Internet; you cannot hide it behind something else. Every appliance is visible in Shodan or Censys, version included.
Everything passes through it. Compromising the gateway means sitting where the credentials, sessions and traffic of the whole organization transit: the position months of lateral movement aim for, obtained on day one.
It escapes internal defenses. No EDR agent on a closed proprietary firmware, often poor logging, few forensic capabilities: it is the exact blind spot of the past decade's detection investments.
It is a monoculture. A few product lines equip an enormous share of the global installed base. A single CVE opens tens of thousands of identical doors, where an application flaw has to contend with deployment diversity.
Its configuration is a balancing act. Hundreds of rules, options and exceptions accumulated over the years: it is easy to make a configuration mistake, that remains human. One administration interface left exposed or one overly permissive rule is enough to cancel everything the appliance brings.
It is poorly maintained. Rebooting the VPN gateway cuts off every remote worker; the end-of-life appliance "that works" stays in production for years. The DBIR puts a number on that lag: a 43-day median to fix a flaw known to be exploited.

Add the underlying irony: these boxes are bought precisely to reduce risk. Every embedded security function (TLS inspection, authentication portal, compliance agent) is additional privileged code, hence additional attack surface. The trust granted to the appliance rests on no verifiable property of its software; it rests on its declared function. Which is exactly the definition of misplaced trust.

The VPN, or trust displaced

This slide, trusting the function rather than the code, reaches beyond the enterprise world, and current events just provided a remarkable illustration. In July 2026, the U.S. Treasury sanctioned a VPN service for the first time in its history: First VPN Service (1VPNS), along with its administrator. Since 2014, the service had been marketed on cybercrime forums with one killer argument, "no logs, no cooperation with law enforcement", and served as anonymization infrastructure for ransomware groups attacking Western organizations, with losses running into the billions. The sanctions follow the takedown of its infrastructure in an international operation in May 2026.

The case is instructive beyond itself: 1VPNS's sales pitch to criminals (no-logs, opacity, unreachable jurisdiction) is word for word what the consumer VPN market sells to the public as a security promise. The same property, unverifiability, is sold on one side as a service to crime, on the other as protection. That should give pause.

Consumer VPNs: routing through someone else's computer

It needs to be said plainly what a commercial VPN technically is: an encrypted tunnel to someone else's computer, which then forwards your traffic out to the Internet. The encryption only covers the leg between you and the provider. At the exit point, the provider sees everything your ISP used to see: every site contacted, every timestamp, every volume, all tied to an account, and often to a payment method. A VPN does not remove the observer of your traffic; it picks a different observer. The question is therefore never "am I protected?" but "to whom did I transfer visibility, and why would I trust them more than my ISP?".

Marketing tells the opposite story. The consumer VPN market massively funds content creators (VPN sponsorship is one of YouTube's most profitable ad formats) on a discourse of technically inaccurate fear: public Wi-Fi that "exposes your passwords," a bank account "hackable" without a VPN. In 2026, the overwhelming majority of web traffic is encrypted end to end by TLS: your banking session is encrypted by your bank, VPN or not. What the subscription actually changes is that the entirety of your activity now transits through a third party you have no means of auditing.

And that third party is not always who you think. The Tech Transparency Project showed that 20 of the 100 most popular free VPN apps on the U.S. App Store were quietly owned by Chinese companies, hidden behind cascades of offshore shells, several linked to Qihoo 360, a company under U.S. sanctions and designated a "Chinese military company" by the Pentagon. Over 70 million downloads, and users who, believing they were protecting themselves, voluntarily route their entire browsing through entities subject to national security laws that mandate data handover. The economics of free VPNs were never mysterious anyway: when the tunnel is not paid for, the traffic is the merchandise.

Let us be precise about the verdict, because the tool is not the problem, the use case is. Using a commercial VPN for convenience (watching a foreign streaming catalog, getting around a geoblock) is a perfectly reasonable trade-off: the stakes are low, the service rendered is real. Using that same tunnel for your work or your bank accounts inverts the benefit/risk ratio: you gain no protection TLS does not already provide, and you add an unauditable intermediary positioned to observe, at worst to tamper with, everything that matters. The rule fits in one sentence: the more sensitive the traffic, the less it should go through a tunnel you do not control.

The VPN actually worth having: your own

There is, however, one VPN use that is genuinely useful for an individual: hosting your own, at home. The principle is the same encrypted tunnel, except it lands on your router or on a small machine in your living room rather than on a stranger's server. When you are away, you connect to your own network: you exit to the Internet through your home connection, and along the way you reach everything left at home (NAS, printer, home automation, the computer left on) without ever exposing those devices to the Internet.

The comparison fits in one diagram. In both cases, an encrypted tunnel; the whole difference is what sits at the end: on one side a third party you pay to observe your traffic, on the other your own network, with access to your local infrastructure as a bonus.

Commercial VPN or VPN at home: what sits at the end of the tunnelLuksMentis diagram. In both cases the tunnel is encrypted; the whole difference is who sits at the other end · luksmentis.com · July 17, 2026

And unlike the subscription, it is free if you are reasonably comfortable with the setup: many routers and ISP boxes already ship with a VPN server, and free software such as WireGuard or OpenVPN covers the rest. Going through a commercial third party adds no protection; going through your own home adds, on top of the tunnel, access to your own network. For the same service, there is no reason to pay to lose out.

What to do

For organizations. The perimeter now demands the treatment once reserved for critical exposed servers:

Inventory the edge devices: every appliance reachable from the Internet, its version, its end-of-support date. A forgotten gateway at a subsidiary is as valid a target as headquarters; attackers enumerate, and they do it well.
Patch the edge devices in days, not weeks. A KEV-listed CVE on an edge device warrants emergency handling (24-72h), triggered by exploitation status, not by CVSS score, not by the monthly cycle. The DBIR's 43-day median is, for this specific family, an intrusion window.
Reduce what is exposed: administration interfaces never reachable from the Internet; VPN portals restricted where possible (geographic or range-based filtering); unused services disabled.
Stop treating the appliance as a trusted component: logs exported off-box in real time (the intruder will wipe them locally), phishing-resistant authentication in front of every remote access, and monitoring of the appliance's own behavior. A gateway opening unusual outbound connections is a signal, not noise.
Plan for end of life: an appliance no longer receiving patches is not an amortized asset, it is a door without a lock. The 2025-2026 campaigns massively targeted end-of-support hardware.

For individuals. Three questions before paying for a VPN subscription: what am I trying to protect, from whom, and is the provider more trustworthy than my ISP? For streaming and geoblocks: go ahead. For banking, administrative matters and work: the commercial VPN adds nothing TLS does not already do, pass. For remote access to your own network and devices: a VPN hosted at home (router, WireGuard, OpenVPN), free and under your control. And for your employer's resources, one rule only: exclusively the VPN your employer provides and manages.

The perimeter has turned

The perimeter is not dead; the industry has been announcing its death for fifteen years, and it is still here. It did something worse: it turned. The device bought to filter intrusions has become, statistically, their leading vector; the tunnel sold to protect browsing has become a private observation point; and the public accounting of the threat confirms, figure after figure, that the trusted appliance is the precise place where trust is least verifiable. The lesson of 2026 fits in one line: trust is not decreed by a device's function; it is limited, monitored and revoked, whether the box is a six-figure enterprise gateway or a free VPN app.

Sources

Verizon, 2026 Data Breach Investigations Report (exploitation = #1 initial access vector at 31%, a first in 19 years; edge/VPN from 3% to 22% of exploitation-driven breaches; 26% of KEV remediated; 43-day median remediation): verizon.com
GreyNoise, The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates (59 silent ransomware reclassifications in 2025, including 19 network security appliances): greynoise.io; coverage by SecurityWeek
CISA, Known Exploited Vulnerabilities Catalog (public source of our mirror): cisa.gov
U.S. Treasury / OFAC, first-ever sanction of a VPN service (First VPN Service/1VPNS, July 2026): The Hacker News, BleepingComputer
Tech Transparency Project, Apple Offers Apps With Ties to Chinese Military (20 of the 100 most popular free VPN apps on the U.S. App Store under concealed Chinese ownership; 70M+ downloads): techtransparencyproject.org; coverage by NBC News
LuksMentis, Report: the state of the cyber threat in H1 2026 (ransomware and vulnerabilities chapters) and Minor vulnerabilities: the end of tacit acceptance in the AI era
Primary data: LuksMentis mirror of CISA's KEV catalog, July 2026 extract (1,647 CVEs, 329 ransomware-linked; product-by-product family classification; analysis restricted to the strict KEV mirror, independent of our June 2026 CVE ingestion expansion)