#vpn

SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of them on VPNs, gateways and remote-access tools rather than identity products, and the median exploited CVE reached KEV 5 days after disclosure.

CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576 chained with the CVE-2026-104935 login bypass. Federal deadlines are November 2 and November 13.

Group-IB and NyxLab reported on October 21 that k0t, a likely initial access broker, broke into Fortinet and Palo Alto edge devices with known CVEs and brute force, decrypted stolen FortiGate configs, and exposed more than 70,000 credentials tied to network devices and LDAP dumps.

Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A patch closes the door, but the passwords, keys and certificates that walked out stay valid until you rotate them.

Unit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then in one case pivoted to vCenter and dumped credentials offline from a domain controller's virtual disk.

Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with CVE-2025-61624, which CISA added to KEV on October 16, and stole VPN credentials from 500+ firewalls.

CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by an actor that went on to harvest LDAP and Active Directory credentials. KEV deadline October 16.

CVE-2026-107406 can lead to remote code execution on NetScaler ADC and Gateway appliances configured as a SAML identity provider or service provider. Fixed in 14.1-73.46 and 13.1-64.29; no exploitation reported yet.

A joint FBI and USSS advisory says the FortiBleed credential campaign is still scanning FortiGate VPNs with stolen logins, and some victims are being locked out when attackers delete or change the original admin accounts. No CVE is involved.

CVE-2026-102255 lets an unauthenticated attacker use an unintended access path in the SMA1000 WorkPlace interface to reach internal functions. CVSS 10.0, fixed in 12.4.3-03670 and 12.5.0-03082, with no workaround.