Published: 12 November 2026 | Updated: 12 November 2026
TL;DR
Attackers are increasingly breaking in through internet-facing edge appliances, such as firewalls, VPN gateways and SSL VPN appliances, instead of stealing passwords. When a flaw can be exploited before login, MFA never gets a chance to help. The answer is layered: replace broad VPN access with Zero Trust Network Access, keep critical systems segmented away from remote-access devices, maintain a live inventory of everything exposed to the internet, and use high-availability pairs so emergency patches don’t mean downtime.
Who this guide is for
This guide is for CISOs, security architects, network engineers and IT infrastructure teams in mid-size and large organizations that rely on firewalls, VPN gateways or SSL VPN appliances for remote access.
When to use this guide
Use this guide if you are reviewing your remote-access security after a new firewall or VPN vulnerability, planning a move from VPN to Zero Trust Network Access, or building a business case for security investment beyond MFA.
Use cases it supports
– Prioritizing emergency patches for internet-facing appliances
– Limiting what a compromised VPN gateway can reach through network segmentation
– Building an inventory of exposed devices, ports and management interfaces
– Planning maintenance windows with high-availability firewall pairs
For years, enterprise security has focused heavily on protecting user identities. Organizations have invested in multi-factor authentication (MFA), stronger password policies, and employee awareness programs to reduce the risk of phishing and credential theft. The assumption was simple: if attackers could not compromise user accounts, they would have a much harder time getting into corporate networks.
But the way attackers gain access is changing.
Recent incident response reports published in October 2026 point to a growing shift in initial access techniques. Vulnerability exploitation is increasingly being used ahead of stolen credentials, particularly when attackers target internet-facing infrastructure.
Rather than spending time trying to trick employees into sharing their passwords, attackers are increasingly looking for weaknesses in the systems that provide remote access to corporate networks. Firewalls, VPN gateways, and other edge appliances have become attractive targets because they are directly exposed to the internet and often provide access to critical internal resources.
This creates a security challenge that traditional identity-focused defenses alone cannot address.
The Shift: How the Network Perimeter Became a Target
Recent vulnerability disclosures involving enterprise edge infrastructure highlight the scale of this problem. These include reported vulnerabilities in Palo Alto Networks PAN-OS (CVE-2026-0322) and critical remote code execution issues affecting SonicWall SMA 1000 appliances.
Unlike vulnerabilities in internal business applications, these weaknesses affect devices that sit directly between corporate networks and the public internet.
Firewalls, VPN gateways, and load balancers are designed to accept external connections. This makes them essential for remote access, but it also means attackers can continuously probe them for weaknesses.
When an attacker finds an unauthenticated or privilege-escalation vulnerability, the consequences can be serious.
- MFA may not protect against the attack: If the vulnerability can be exploited before the authentication process begins, an attacker may gain access without needing valid credentials or an MFA token.
- Administrative access can be compromised: Certain vulnerabilities can allow attackers to execute commands or gain elevated privileges on the appliance itself.
- The compromised device can become an entry point: Once an edge appliance is compromised, attackers may attempt to access internal systems, inspect network traffic, identify valuable assets, and move further into the environment.
In these situations, the problem is no longer just about protecting user accounts. It is about protecting the infrastructure that controls access to the network.
Why Edge Devices Are Particularly Vulnerable
Edge devices are vulnerable because they are always exposed to the internet, hard to patch quickly without downtime, rarely covered by EDR tools, and often trusted too much once a user connects.
There are several reasons why edge appliances have become attractive targets. Some are related to how these devices are managed, while others come from limitations in traditional network security architectures.
1. The Patching Challenge
Firewalls and VPN gateways are critical to day-to-day business operations. Taking them offline for maintenance can interrupt remote access and affect employees, customers, and business applications.
As a result, IT teams sometimes delay firmware updates, particularly when they need additional time to test compatibility or coordinate maintenance windows.
This creates an opportunity for attackers. Once a vulnerability becomes public, exposed devices that have not been patched can quickly become targets.
The challenge is finding a balance between maintaining availability and responding quickly to security issues.
2. Limited Visibility into Edge Devices
Most traditional Endpoint Detection and Response (EDR) solutions are designed for servers, laptops, and workstations. They cannot always be installed on proprietary network appliances.
Security teams therefore depend heavily on the monitoring and logging capabilities provided by the appliance manufacturer.
This can create visibility gaps. If an attacker compromises the underlying operating system or firmware, they may be able to interfere with logging or other security controls.
Without independent monitoring, identifying suspicious activity on these devices can become difficult.
3. Too Much Trust After Authentication
Many traditional network architectures still rely on the assumption that users who successfully connect through a VPN can be trusted to access a wider portion of the corporate network.
In practice, this often means remote employees receive broader network access than their roles actually require.
If an attacker compromises a VPN gateway, they may be able to take advantage of these existing access permissions.
This is one of the reasons why network access should be restricted based on individual users, devices, applications, and business requirements rather than simply allowing access based on network location.
How Organizations Can Reduce the Risk
In short: limit what a compromised appliance can reach, keep track of everything you expose to the internet, and make patching fast enough that attackers don’t get a window. The four controls below do exactly that.
Patching vulnerabilities remains essential, but it should not be the only line of defense. Organizations also need to consider what happens if an internet-facing appliance is compromised.
A more resilient approach combines restricted access, network segmentation, continuous monitoring, and better infrastructure management.
1. Move from Traditional VPNs to Zero Trust Network Access (ZTNA)
Traditional VPNs typically provide users with network-level access after successful authentication. Depending on the configuration, this can expose more internal resources than the user actually needs.
Zero Trust Network Access (ZTNA) takes a different approach.
Instead of providing broad network access, ZTNA connects users to specific applications based on their identity, device health, and access permissions.
For example, an employee who needs access to a CRM application should not automatically receive access to internal databases, development servers, or other corporate systems.
This reduces the potential impact of compromised accounts and remote-access infrastructure.
| Factor | Traditional VPN | Zero Trust Network Access (ZTNA) |
|---|---|---|
| What a user gets after login | Network-level access to a broad segment | Access only to specific approved applications |
| How access is decided | Mostly by network location once authenticated | By identity, device health and permissions |
| If the gateway or an account is compromised | Attacker can inherit wide network access | Attacker reaches only what that identity is allowed |
| Lateral movement | Easier, unless the network is segmented | Harder by design |
| Still needs patching and monitoring? | Yes | Yes, ZTNA gateways must also be secured and updated |
However, ZTNA is not a complete solution on its own. The gateways and services supporting it must also be properly secured, monitored, and updated.
2. Implement Network Micro-Segmentation
Network segmentation helps limit how far an attacker can move after gaining access to an environment.
Critical systems such as Active Directory, production databases, and backup infrastructure should not be freely accessible from the same network segments used by remote-access appliances.
Micro-segmentation takes this further by applying access restrictions between individual workloads and systems.
For example, a compromised VPN gateway should not automatically be able to communicate with backup servers or production databases.
By enforcing these restrictions, organizations can reduce the impact of a successful attack and make lateral movement more difficult.
3. Continuously Monitor the External Attack Surface
Organizations often have more internet-facing infrastructure than they realize. Legacy VPN gateways, forgotten test environments, outdated appliances, and exposed management interfaces can all introduce security risks.
Continuous Attack Surface Management (CASM) helps identify these assets from an external perspective.
Security teams should maintain an updated inventory of:
- Public-facing IP addresses and domains.
- Open ports and exposed management interfaces.
- Internet-facing firewalls and VPN appliances.
- Firmware versions and known vulnerabilities.
- Legacy systems that are no longer actively maintained.
Automated monitoring can help identify newly exposed services and outdated devices before attackers discover and exploit them.
4. Improve Emergency Patching and High Availability
One of the biggest reasons organizations delay security updates is the risk of service disruption.
High-availability infrastructure can help address this challenge.
For example, organizations using active-passive firewall configurations can test updates on standby appliances before switching traffic to them.
A properly designed staging environment also allows IT teams to validate firmware updates and identify compatibility issues without affecting production systems.
The goal is to make emergency patching a planned operational process rather than something that requires prolonged downtime.
Organizations should also establish clear patching priorities based on vulnerability severity, active exploitation, exposure, and business impact.
Moving Forward: Security Needs to Go Beyond Password Protection
MFA, strong passwords, and identity protection remain important parts of enterprise security. However, they cannot prevent every type of attack, particularly when vulnerabilities exist in the infrastructure responsible for managing access.
The growing focus on edge appliances highlights an important gap in traditional security strategies. Organizations have spent years strengthening user authentication, but the systems sitting between their networks and the public internet need the same level of attention.
Security teams should treat internet-facing appliances as critical assets, not simply networking equipment that can be updated during routine maintenance.
Restricting access through Zero Trust principles, implementing network segmentation, maintaining visibility into exposed infrastructure, and improving patch management can significantly reduce the risk.
The objective is not to assume that every security control will work perfectly. It is to ensure that when one layer fails, the attacker cannot easily move through the rest of the environment.
Frequently Asked Questions
Why are attackers targeting edge appliances instead of stealing passwords?
Edge appliances such as firewalls and VPN gateways sit directly on the internet and often lead straight into the internal network. Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation (31%) has overtaken credential abuse (13%) as the most common way attackers get in.
Can MFA protect against VPN and firewall vulnerabilities?
Not always. If a flaw can be exploited before the login step, the attacker never reaches the MFA prompt. In September 2026, SonicWall confirmed attackers were chaining two SMA 1000 flaws (CVE-2026-83548 and CVE-2026-83549) to run code on the appliance without any credentials.
What is the difference between a VPN and ZTNA?
A traditional VPN usually gives users network-level access once they authenticate. Zero Trust Network Access connects each user only to the specific applications they are allowed to use, based on identity, device health and permissions, so a compromised account or gateway reaches far less.
How does micro-segmentation reduce the impact of a compromised VPN gateway?
Micro-segmentation applies access rules between individual systems, so a compromised VPN gateway cannot automatically reach backup servers, production databases or Active Directory. The attacker has to get past additional controls to move laterally.
How should we prioritize patching for internet-facing appliances?
Rank updates by severity, active exploitation, exposure and business impact. Treat anything listed in CISA’s Known Exploited Vulnerabilities catalog as urgent, and use high-availability pairs to patch the standby appliance first so emergency fixes don’t require long downtime.