Exploiting VPNs, firewalls and edge devices
Breaking in through internet-facing equipment (VPN gateways, firewalls, remote-access appliances) using unpatched or unknown flaws.
New
10 attacks reported in the last 90 days (0 in the 90 before)
10 in 12 months
MITRE ATT&CK: T1190, T1133
Our deep dive on this technique is being prepared from our reporting. The attacks we have covered are below.
Attacks we reported
- Ivanti Connect Secure flaw CVE-2026-111357 is being actively exploited, CISA warns
- Zero Day Initiative discloses SSRF-to-RCE in Oracle PeopleSoft
- Fortinet Multiple Products flaw CVE-2025-61624 is being actively exploited, CISA warns
- BeyondTrust Remote Support flaw CVE-2026-102764 is being actively exploited, CISA warns
- Palo Alto Networks PAN-OS flaw CVE-2026-0322 is being actively exploited, CISA warns
- Cisco Secure Email Gateway flaw CVE-2026-76519 is being actively exploited, CISA warns
- Unit 42 Details Bank Intrusion Tied to Third-Party Gateway
- Ivanti Connect Secure flaw CVE-2026-104935 is being actively exploited, CISA warns
- Citrix NetScaler flaw CVE-2026-88779 is being actively exploited, CISA warns
- NCSC warns of active exploitation in Citrix NetScaler flaws
All hacking techniques · We explain how attacks work so you can defend against them; we never publish instructions for carrying one out.