Your VPN is the front door — and attackers have the key

CVE-2026-50751 is an authentication bypass. In plain terms, it let an attacker skip the part where you prove who you are. The flaw lived in an old, deprecated piece of the VPN's setup (a legacy protocol called IKEv1), and it carried a severity score of 9.3 out of 10. An unauthenticated attacker on the internet could establish a remote-access VPN session without a password — which is to say, they could log in as if they belonged there.

It was exploited as a zero-day: attackers were using it before any fix existed. Observed activity went back to around May 7, 2026, with a spike in early June, and the advisory only landed on June 8. This was not mass, internet-wide scanning — it was a few dozen targeted organizations. The U.S. cybersecurity agency added it to its must-patch list the same day with a three-day deadline for federal agencies. The fix: install the hotfix, and turn off the deprecated protocol nobody should still have been running.

Days earlier, Cisco confirmed that a flaw in its Catalyst SD-WAN Manager — CVE-2026-20245 — was also being exploited. This one is different in an important way, and it is worth being precise: it is not a front-door bypass. An attacker already needs a foothold with admin rights on the system. What the bug gives them is the final step — escalating to full root control.

Why that still matters: the SD-WAN Manager is the brain of a modern network. It pushes configuration down to every branch and edge device. Take it over and you do not control one box — you potentially control the whole fabric. Google's Mandiant confirmed a real intrusion, the work of a highly capable, unnamed attacker who went to unusual lengths to cover their tracks. By some counts it was Cisco SD-WAN's seventh zero-day of 2026. Two different bugs, one theme: the control points of the network are under sustained, skilled attack.

An edge device is any box that sits at the boundary between your network and the internet — VPN gateways, firewalls, SD-WAN managers, email gateways, load balancers. They are the gatekeepers.

That role is exactly what makes them dangerous when they fall. By design, an edge device is exposed to the entire internet on one side and trusted by everything inside on the other. Breach a laptop and you are one machine deep. Breach the VPN gateway and you are not knocking at the perimeter — you are already past it, often with the privileges of a trusted system. The gatekeeper has the keys to everything it guards.

This is not bad luck or a run of unrelated bugs. It is structural. According to Mandiant's annual M-Trends report, exploiting internet-facing systems has been the single most common way attackers break in for six years running — around a third of all intrusions where the entry point could be identified. Edge devices dominate that category. The four most-exploited vulnerabilities of 2024 were all edge appliances.

Four things make them soft targets. They are exposed to the internet by definition, so they are always reachable. They run closed, embedded operating systems that cannot run the antivirus or endpoint-detection tools that watch your laptops and servers — so they are a monitoring blind spot. They ship with thin logging or none, so an intrusion can come and go unseen. And they sit outside normal patch cycles, often running well past their end-of-life. Put together, that is a high-value, internet-facing, hard-to-watch, slow-to-patch target. Attackers noticed.

Both of these were zero-days: actively exploited before the vendor had a patch. That word matters because it breaks a comforting assumption. "We patch promptly" does not protect you when the window of exposure opens before the patch is even written.

This is why the modern defense cannot be only "keep up with updates." It has to assume the edge can and will be breached, and focus on limiting what a breach actually buys the attacker. The goal shifts from "never get hit" to "a hit on the gateway does not hand over the whole network."

When the U.S. cybersecurity agency lists a flaw in its Known Exploited Vulnerabilities catalog, it is saying: this is being used against people right now. The deadlines attached to those listings keep shrinking — three days for the Check Point flaw.

The reason is simple math. The moment a fix ships, attackers reverse-engineer it to learn exactly what it patched, and proof-of-concept exploit code often appears within days. The gap between "patch released" and "everyone is being attacked" has collapsed from months to days. For internet-facing devices, patch speed is no longer hygiene. It is survival.

Inventory every internet-facing device you own. Most organizations have more than they think, and the forgotten appliance is the one that gets used. You cannot protect what you do not know is exposed.

Patch edge devices on an emergency track — hours to days, not the monthly cycle you use for laptops. Turn off deprecated features and protocols; the Check Point flaw lived in a legacy component few people still needed. Retire end-of-life appliances that are still exposed. Because these boxes will not run endpoint-detection software, get their logs off the device and into something you actually monitor — that external logging is often your only chance to see an intrusion. And assume breach: segment your network so that a compromised VPN or SD-WAN box is not the same thing as losing everything. Finally, watch the Known Exploited Vulnerabilities catalog — if your gear is on it, you are already on the clock.

The security industry sold the edge appliance as a wall. It is more honest to think of it as a door — a high-value, internet-facing, hard-to-monitor door that opens onto everything inside, sometimes with the keys already in the lock.

That does not mean rip them out; you need them. It means inverting how you think about them. Your VPN gateway and firewall are not your strongest defense. They are among your most exposed assets, and they deserve your fastest patching, your closest monitoring, and an architecture that assumes one of them will eventually fall.