// #vpn
11 articles
CVE-2026-50751: Check Point Security Gateway Authentication Bypass Actively Exploited in Ransomware Campaigns
CISA added CVE-2026-50751 to the Known Exploited Vulnerabilities catalogue on 8 June with a three-day remediation deadline and confirmed ransomware campaign use. The vulnerability is a CVSS 9.3 authentication bypass in Check Point Security Gateway's IKEv1 VPN protocol handling that allows unauthenticated attackers to bypass remote access VPN authentication entirely. An emergency hotfix is available.
Assessing Network Perimeter Device Security: A Methodology for Firewalls, VPN Gateways, and Load Balancers
Network perimeter devices — firewalls, VPN gateways, and load balancers — are the most frequently exploited initial access category in enterprise breaches. Despite this, they are often excluded from regular security assessments. This methodology covers how to assess the security posture of perimeter network devices without disrupting production operations.
VPN Gateway Security: Hardening the Network Perimeter Device That Attackers Target First
VPN gateways and remote access concentrators have become the most frequently exploited initial access vector in enterprise network intrusions. With critical vulnerabilities regularly disclosed in Palo Alto GlobalProtect, Citrix NetScaler, Fortinet FortiGate, and now Check Point Security Gateway, this guide covers the security hardening and monitoring posture that reduces exposure regardless of which vendor's appliance your organisation runs.
GlobalProtect CVE-2026-0257 Compromise Indicators: Threat Hunting and Forensic Guide for VPN Gateway Authentication Bypass
Organisations running PAN-OS GlobalProtect gateways on versions vulnerable to CVE-2026-0257 must investigate for compromise during the exposure window, not just apply the patch. This guide covers the specific log sources, indicators of compromise, and post-exploitation patterns to hunt for on PAN-OS GlobalProtect gateways after an authentication bypass zero-day.
PAN-OS GlobalProtect CVE-2026-0257: Rapid7 Confirms Second Exploitation Wave — CISA Adds to KEV
Rapid7 MDR confirmed on 21 May that a second, larger exploitation wave of CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect VPN, began on 21 May targeting enterprise sectors not covered in the initial wave. CISA added the CVE to the Known Exploited Vulnerabilities catalogue with a 1 June remediation deadline. The vulnerability affects PAN-OS 10.2, 11.1, 11.2, and 12.1 as well as Prisma Access.
VPN Authentication Bypass: Identity and Access Containment Response After GlobalProtect Compromise
When a VPN authentication bypass like CVE-2026-0257 is exploited, the attacker enters the network without leaving identity provider audit trails. Standard identity-based detection misses the initial access. This creates a specific response challenge: containing a network breach where the entry event did not generate authentication telemetry and the scope of subsequent access is unknown.
SonicWall EoL Highlights an Asset Management Gap: Network Equipment Lifecycle Tracking in Enterprise Environments
The SonicWall Generation 6 end-of-life situation reveals a consistent gap in enterprise asset management: network equipment EoL dates are not tracked with the same rigour as software licence renewals or server hardware refresh cycles. Organisations with accurate, proactively managed network equipment lifecycle records have a weeks-to-months advantage in responding to EoL-driven security risks.
End-of-Life VPN Appliances: A Security Assessment Framework for Identifying Unsupportable Network Equipment
The SonicWall Generation 6 end-of-life situation is the latest instance of a recurring enterprise security problem: internet-facing network equipment that reaches vendor end-of-life while still actively exploited. A structured assessment approach helps security teams identify, prioritise, and communicate the risk of EoL perimeter equipment.
SonicWall Gen6 SSL-VPN: Patch for CVE-2024-12802 Fails to Close MFA Bypass — Akira Ransomware in 86% of Compromises
ReliaQuest published research on 19 May confirming that SonicWall's official firmware patch for CVE-2024-12802 on Generation 6 SSL-VPN devices requires six manual reconfiguration steps to fully close the MFA bypass vulnerability. Devices that reached end-of-life on 16 April 2026 will receive no further patches. Akira ransomware is present in 86% of SonicWall-involved intrusion claims reviewed by ReliaQuest.
SonicWall CVE-2026-0204 — Authentication Bypass in SSLVPN Allows Unauthenticated Network Access
SonicWall has disclosed CVE-2026-0204, an authentication bypass vulnerability in the SonicWall SSLVPN product that allows a remote attacker to bypass VPN authentication and gain access to the protected network without valid credentials. SonicWall SSLVPN appliances are widely deployed as enterprise and SMB VPN concentrators. Patch available — update immediately.
Palo Alto PAN-OS CVE-2026-3197: SAML Auth Bypass Under Mass Exploitation by Nation-State Actors
A critical SAML authentication bypass in Palo Alto Networks PAN-OS GlobalProtect allows unauthenticated remote attackers to gain administrative firewall access. CVE-2026-3197 chains with a command injection flaw to achieve root-level OS execution and is being exploited by at least three distinct threat actor clusters including a China-nexus nation-state group. CISA has added it to the KEV catalogue.
Commentary tagged #vpn
VPN Gateways Are Where Ransomware Gets In. CVE-2026-50751 Is Not the Last One.
Check Point CVE-2026-50751 joins a long list of critical authentication bypass and remote code execution vulnerabilities in enterprise VPN gateways that have been exploited in ransomware campaigns. The pattern is consistent enough that it is no longer useful to treat each as a one-off incident — it is a structural category of risk that requires a structural response.
CipherWatch Editorial
Security Intelligence Platform
Two PAN-OS GlobalProtect Authentication Bypasses in Three Months Is a Pattern, Not a Coincidence
CVE-2026-0257, a second actively exploited Palo Alto Networks GlobalProtect authentication bypass in the same three-month window as CVE-2026-0300, is not bad luck. It reflects the structural dynamics of high-value attack surface concentration: when enterprise VPN infrastructure is widely deployed, highly privileged, and technically complex, it attracts sustained, focused research from both legitimate researchers and threat actors.
CipherWatch Editorial
Security Intelligence Platform
End-of-Life Equipment Is Not a Budget Problem — It's a Security Architecture Decision
The framing of end-of-life network equipment as a procurement or budget problem is systematically incorrect. EoL equipment with active CVEs is a deliberate security architecture choice to operate known-exploitable infrastructure. Treating it as such changes the conversation, the decision-makers involved, and the urgency applied.
CipherWatch Editorial
Security Intelligence Platform