Your Security Appliances Are the Attack Surface

Security and networking appliances now represent the most consistently targeted category of enterprise technology for zero-day exploitation. The devices organizations buy to defend the perimeter have become the most productive way through it.

Firewalls, VPN gateways, and secure access appliances are the most reliably exploited category of enterprise technology. Google's Threat Intelligence Group tracked 21 zero-days targeting security and networking products in 2025, part of an enterprise exploitation share that hit an all-time high of 48%. In 2024, the tilt was steeper, with 20 of 33 enterprise zero-days targeting security and networking devices directly. Our analysis of CISA's Known Exploited Vulnerabilities (KEV) catalog confirms the pattern at scale, with one in five actively-exploited entries coming from security and network infrastructure vendors and the share climbing to 25.4% in the first half of 2026.

At a Glance

• Security and networking products accounted for 21 enterprise zero-days in 2025, and enterprise technology overall reached an all-time high share at 48% of all zero-days tracked by Google's Threat Intelligence Group.

• Products from security and network infrastructure vendors account for 342 of 1,653 CISA KEV entries, one in five confirmed actively-exploited vulnerabilities. The share reached 25.4% in the first half of 2026, the highest annual proportion since the catalog launched.

• 75 security appliance KEV entries are flagged as entry points for known ransomware campaigns. Ivanti, SonicWall, and Fortinet products lead the ransomware-associated count.

• Command and code injection (27%) and authentication and access-control weaknesses (17%) dominate the CWE profile of CRITICAL and HIGH severity CVEs across six major security appliance vendors in NVD.

• China-aligned threat groups account for at least seven of ten major edge-device exploitation campaigns tracked by Trend Micro in 2024-2026, with the exploitation window compressing from weeks to days.

• 55 security appliance CVEs in the KEV catalog currently carry EPSS scores above 0.9, indicating near-certain exploitation probability.
  
  

The Architectural Trap

When an Ivanti or Fortinet zero-day drops, the response playbook is predictable. Patch immediately, check for indicators of compromise, reset credentials. The implicit assumption is that these are ordinary software bugs in otherwise sound infrastructure, flaws to fix rather than symptoms of a design problem.

Network security appliances concentrate three properties that attackers value into a single target. They are internet-facing by design. They hold elevated trust positions on the network, terminating VPN sessions, inspecting traffic, and managing access to internal segments. And they run complex proprietary software stacks that resist independent security review.

Most carry no endpoint detection and response agent because the vendors build both the OS and the management plane as a closed system. When a firewall is compromised, the attacker inherits the device's trust position, its visibility into network traffic, and its management access. The compromise is invisible to the security stack because the compromised device is the security stack.

GTIG noted this detection gap directly, observing that the absence of EDR coverage on routers, firewalls, and VPN appliances creates blind spots that threat actors actively seek. Mandiant's M-Trends 2026 report described edge and core network devices as "frequently uncatalogued and unmonitored" gateways that grant adversaries "invisible, long-term access." Attackers have identified the perimeter security appliance as the point where maximum trust meets minimum visibility, and they are working through the vendor list methodically.

What the KEV Catalog Shows

Cisco leads all security and network infrastructure vendors in KEV entries with 143, a function of both market share and product breadth spanning firewalls, VPN concentrators, switches, routers, and identity services. Ivanti follows at 39, heavily concentrated in Connect Secure and Policy Secure VPN products. Citrix has 31 entries, Fortinet 28, SonicWall 27, Zyxel 16, and Palo Alto Networks 15.

The year-over-year trend is gradual but directional. Security appliance vendors held near 20% of annual KEV additions from 2021 through 2024, then climbed to 21.2% in 2025 and 25.4% in the first half of 2026. That 2026 figure represents the highest annual share since the catalog launched, though the year is incomplete.

Annual KEV additions with security appliance vendor share. 2026 data covers January through July. 

Seventy-five of these entries carry CISA's ransomware flag, marking them as confirmed entry points for ransomware campaigns. Ivanti products lead the ransomware-associated count at 14, followed by SonicWall and Fortinet at 13 each, Cisco and Citrix at 9, and Palo Alto Networks at 6.

The devices that organizations purchase to prevent ransomware intrusions are documented ransomware entry points.

Security appliance vendor KEV entries flagged as used in known ransomware campaigns. 

Basic Flaws at Root Level

The weakness profile explains why exploitation is so productive. Across CRITICAL and HIGH severity CVEs for Ivanti, Fortinet, Palo Alto Networks, SonicWall, Citrix, and Barracuda in NVD, command and code injection accounts for 27% of CWE classifications, making it the largest identified category. OS command injection alone (CWE-78) appears 120 times, and SQL injection (CWE-89) appears 105 times. Path traversal (CWE-22) adds another 80 instances. These are web application security failures that the industry solved decades ago in other contexts. In a network security appliance running at root on the network perimeter, each one hands the attacker the device's full trust position.

Authentication and access-control weaknesses account for 17% of the CWE classifications. Improper authentication (CWE-287, 33 instances), missing authentication for critical functions (CWE-306, 25 instances), and improper access control (CWE-284, 18 instances) appear repeatedly across these vendors. The devices entrusted with enforcing authentication and access control are failing at authentication and access control.

CWE category distribution across CRITICAL and HIGH severity CVEs for six major security appliance vendors. 

China-aligned threat groups have been the most active exploiters. Trend Micro's analysis attributes at least seven of ten major edge-device exploitation campaigns in 2024-2026 to Chinese espionage operations. Eight distinct clusters targeted Ivanti Connect Secure in early 2024 alone, and sustained campaigns hit Fortinet FortiGate and Citrix NetScaler through 2025 into 2026. The exploitation window has compressed from weeks to days. GreyNoise reported that the gap between patch release and widespread exploitation "has effectively collapsed." Fifty-five security appliance CVEs in the KEV catalog currently carry EPSS scores above 0.9, the highest tier of predicted exploitation probability.

Treating Appliances as Adversary Targets

Faster patching is necessary but insufficient. If the architecture concentrates trust in internet-facing devices that attackers can reach before defenders can patch, speed alone is a losing race.

Organizations should treat perimeter security appliances as adversary-accessible endpoints rather than trusted infrastructure. That means deploying network-level detection around the appliances themselves, monitoring for unexpected outbound connections, lateral movement from management interfaces, and configuration changes outside maintenance windows. It means assuming the appliance will be compromised and designing network segmentation so that a compromised firewall or VPN concentrator cannot reach everything behind it. Several vendors now offer integrity monitoring and attestation features for their appliances. If available, enable them.

The longer-term architectural response is distributing security controls away from monolithic perimeter appliances. Zero-trust architectures, identity-aware proxies, and cloud-delivered security reduce the value of compromising any single device by removing the concentration of trust that makes these appliances such productive targets.

Every compromised Ivanti box and exploited FortiGate is a data point in the same argument, that concentrating trust in internet-facing proprietary appliances with no third-party security visibility was always a fragile design. At 21 zero-days per year, vendors cannot patch their way out of the underlying architecture.

Sources

• Google Threat Intelligence Group, "Look What You Made Us Patch: 2025 Zero-Days in Review," 2026

• CISA Known Exploited Vulnerabilities Catalog, retrieved July 24, 2026

• Trend Micro, "Edge Under Siege: How State-Sponsored Actors Exploit Your Perimeter," 2026

• Google / Mandiant, M-Trends 2026 Report

• NVD API 2.0, CVE data for security appliance vendors, queried July 24, 2026

• FIRST EPSS API, exploit prediction scores for security appliance CVEs, queried July 24, 2026