Vpn

vulnerabilities 2026-11-13
Check Point Gaia CVE-2026-123039: DynamicCLI Root Zero-Day Chained With PHP2Shell to Backdoor Gateways and Wipe ESXi
Attackers used PHP2Shell against Check Point Mobile Access portals, then an unauthenticated root socket in Gaia's DynamicCLI daemon (CVE-2026-123039), to backdoor gateways and wipe VMware ESXi hosts. Install the November Jumbo Hotfix and hunt for compromise.
active-exploitation zero-day network-appliance privilege-escalation backdoor vpn
vulnerabilities 2026-11-07
CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML Bypass Exploited in the Wild, CISA Deadline November 20
SonicWall patched an actively exploited SonicOS SSL-VPN flaw that lets attackers with valid credentials sidestep SAML-enforced MFA; CISA added it to KEV on November 6.
active-exploitation cisa-kev authentication-bypass vpn network-appliance sonicwall
vulnerabilities 2026-11-03 High
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: The Missing Privilege Escalation Zero-Days in the UTA0576 Root Chain Are Patched
Ivanti has patched the two remaining Connect Secure zero-days that UTA0576 chained with the CVE-2026-104935 auth bypass to reach root; both are in CISA KEV.
ivanti vpn zero-day privilege-escalation network-appliance active-exploitation cisa-kev
vulnerabilities 2026-10-29
Cisco ASA and FTD Second SSL VPN Zero-Day Since August: CVE-2026-76418 Reloads Firewalls via Secondary Authentication Logic Flaw
Cisco patched CVE-2026-76418, an actively exploited unauthenticated flaw in ASA and FTD Remote Access SSL VPN that lets attackers force firewall reloads when secondary authentication is configured.
active-exploitation zero-day network-appliance vpn denial-of-service
vulnerabilities 2026-10-26 High
k0t Campaign Exposes 70,000+ Credentials from FortiGate, FortiWeb and GlobalProtect Edge Devices
Group-IB and NyxLab detail a suspected access-broker campaign against Fortinet and Palo Alto edge devices that leaked 70,000+ credential records, with unconfirmed ties to ransomware crews.
network-appliance vpn credential-theft access-broker ransomware active-exploitation
vulnerabilities 2026-10-18
SonicWall SMA1000 CVE-2026-102255: CVSS 10.0 Pre-Auth SSRF Probed Within Two Days of Patch
SonicWall's SNWLID-2026-0017 patches CVE-2026-102255, a maximum-severity pre-auth SSRF in SMA1000 that attackers reach an internal CouchDB through; exploitation attempts began two days after the fix.
network-appliance vpn ssrf authentication-bypass sonicwall active-exploitation
vulnerabilities 2026-10-17
PEERSTITCH: Memory-Only FortiGate Implant Deployed via FortiOS CVE-2025-61624 After FortiManager Breach
Unit 42 details PEERSTITCH, a fileless implant injected into FortiOS miglogd and iked after FortiJump and a CVE-2025-61624 path traversal gave root on FortiGate firewalls.
fortinet apt network-appliance vpn privilege-escalation post-exploitation
vulnerabilities 2026-10-14 High
Ivanti Connect Secure CVE-2026-104935: Auth-Bypass Zero-Day Chained to Root by UTA0576, Added to CISA KEV
Ivanti patched an authentication-bypass-by-spoofing zero-day in Connect Secure that Volexity saw chained with a still-unpatched privilege escalation for root access. CISA added it to KEV with an October 16 deadline.
ivanti vpn zero-day authentication-bypass network-appliance active-exploitation cisa-kev
vulnerabilities 2026-10-05
CVE-2026-88779: NetScaler SAML Memory Overflow Zero-Day Crashes Auth, Hits Freshly Patched Appliances
Citrix confirms exploitation of a NetScaler ADC/Gateway SAML memory overflow (CVSS 8.7) that crashes authentication services; honeypot data suggests appliances patched for the previous batch are also being hit.
active-exploitation cisa-kev zero-day network-appliance authentication-bypass vpn
vulnerabilities 2026-09-27
CVE-2026-88771 & CVE-2026-88772: Unauthenticated RCE Zero-Days Hit Every NetScaler Deployment
Citrix confirms two NetScaler ADC/Gateway zero-days under active exploitation — one an unauthenticated command-execution bug present in every default configuration, the other a DTLS memory overflow enabled by default on VPN virtual servers.
active-exploitation cisa-kev network-appliance rce vpn zero-day
vulnerabilities 2026-09-12
CVE-2026-85102 & CVE-2026-85103: Dutch NCSC Warns Exploitation of Check Point VPN Certificate RCE Flaws Is Imminent
Two unauthenticated CVSS 9.8 RCE bugs in Check Point's VPN certificate handling have hotfixes since September 9 — the Dutch NCSC says active exploitation is likely imminent even though no public PoC exists yet.
network-appliance rce vpn zero-day authentication-bypass
vulnerabilities 2026-09-03
CVE-2026-83548 & CVE-2026-83549: SonicWall SMA1000 Hit by Third Zero-Day Chain of 2026, CVSS 10.0 SSRF to Root RCE
SonicWall SMA1000 appliances are under active exploitation via a chained SSRF and OS command injection pair, CVE-2026-83548 and CVE-2026-83549, the product line's third zero-day incident this year.
active-exploitation cisa-kev network-appliance vpn zero-day ssrf
vulnerabilities 2026-08-30
CVE-2026-8452: 'DoS-Only' NetScaler Flaw Turns Out to Be Pre-Auth Root RCE, Now Under Active Exploitation
watchTowr Labs turned a Citrix NetScaler bug Citrix rated as a crash-only memory overflow into pre-auth root code execution; CISA confirms in-the-wild exploitation with web shells on unpatched appliances.
active-exploitation cisa-kev network-appliance rce vpn zero-day
vulnerabilities 2026-08-19
CVE-2026-19490: Critical NetScaler Auth Bypass Lets Attackers Skip the Login Screen Entirely
A critical CVSS 9.3 authentication bypass in Citrix NetScaler ADC and Gateway lets unauthenticated attackers reach protected resources behind SSL VPN, ICA Proxy, and AAA virtual servers — patch CTX696939 now.
authentication-bypass vpn network-appliance zero-day active-exploitation
vulnerabilities 2026-08-12
Cisco ASA and FTD Under Active Attack: Unauthenticated VPN Flaw Reloads Firewalls On Demand (CVE-2026-20349)
CVE-2026-20349, an unauthenticated heap inspection flaw in Cisco ASA and FTD's Remote Access SSL VPN service, is being actively exploited to remotely crash firewalls — CISA gave federal agencies until August 14 to patch, and no workaround exists.
active-exploitation cisa-kev network-appliance vpn denial-of-service
vulnerabilities 2026-08-05
QuickFox VPN Installer Trojanized for a Year to Deliver Mustang Panda's FDMTP Backdoor
A trojanized QuickFox VPN Windows installer quietly delivered the FDMTP backdoor for roughly a year, with Fortinet linking the campaign to Chinese state-sponsored actor Mustang Panda.
supply-chain apt vpn backdoor malware windows
vulnerabilities 2026-07-30
CVE-2026-20316: Static Credentials in Cisco Secure FMC Under Active Exploitation, Added to CISA KEV
Cisco disclosed CVE-2026-20316, a hardcoded low-privilege account baked into Secure Firewall Management Center's web interface that lets unauthenticated attackers log in and pull sensitive data — CISA added it to the KEV catalog on July 29 after confirming in-the-wild exploitation.
active-exploitation cisa-kev authentication-bypass network-appliance vpn
vulnerabilities 2026-07-15
CVE-2026-15409 & CVE-2026-15410: SonicWall SMA1000 Zero-Days Chained for Unauthenticated RCE, CISA Deadline July 17
Two SonicWall SMA1000 zero-days — a CVSS 10.0 SSRF and a post-auth code injection flaw — are being chained in the wild for unauthenticated remote code execution. CISA KEV deadline is July 17, 2026.
active-exploitation cisa-kev network-appliance vpn zero-day ssrf
vulnerabilities 2026-07-02
CVE-2026-8451: A New CitrixBleed-Pattern Memory Overread Is Already Under Active Exploitation
Citrix patched CVE-2026-8451, a pre-auth memory overread in NetScaler's SAML IdP parser that leaks session tokens — and attackers were already exploiting it within 24 hours of disclosure.
active-exploitation vpn network-appliance credential-theft pre-auth
vulnerabilities 2026-06-08 Critical
CVE-2026-50751: Check Point VPN Auth Bypass Exploited by Qilin — IKEv1 Sessions Without a Password
Check Point confirmed active exploitation of CVE-2026-50751, a CVSS 9.3 authentication bypass in Remote Access VPN and Mobile Access deployments running deprecated IKEv1. Attackers establish VPN sessions without a valid password; one case is tied to a Qilin ransomware affiliate. Earliest exploitation traces to May 7.
vpn authentication-bypass ransomware