The authentication gap has migrated to the outermost layer of enterprise infrastructure: the VPN. While previous waves of exploitation targeted middleware, identity providers, and endpoint management systems, the focus has shifted to the gateways that define the perimeter. Recent activity across Palo Alto, Check Point, Cisco, and Citrix confirms that VPN infrastructure is now the primary target for bypassing access controls.
Palo Alto Networks faced a critical test with CVE-2026-0257, an authentication bypass in GlobalProtect. Disclosed on May 13, 2026, the vulnerability allowed attackers to forge authentication override cookies using exposed TLS public keys. The exploitation window was exceptionally narrow; initial attacks were observed on May 17, just four days after disclosure, with a second wave following on May 21. Once authenticated as an administrator, attackers established VPN tunnels and utilized tools like Impacket for NTLM relay and lateral movement.
Check Point’s Remote Access VPN infrastructure was similarly compromised via CVE-2026-50751. This flaw, rooted in IKEv1 certificate validation logic, carried a CVSS score of 9.3. Threat actors, specifically affiliates of the Qilin ransomware group, were actively exploiting this vulnerability as early as May 7, 2026, demonstrating the speed at which attackers weaponize certificate-based weaknesses.
The sophistication of these campaigns is best illustrated by the Cisco SD-WAN compromise involving CVE-2026-20182. Disclosed on May 14, 2026, this CVSS 10.0 vulnerability was targeted by the UAT-8616 threat actor. Cisco Talos identified the group as highly sophisticated, utilizing ORB networks to mask their activity. The exploit granted administrative access and NETCONF control over TCP/830. Post-compromise actions included injecting SSH keys and modifying configurations to introduce rogue peers, affecting all deployment types, including those within FedRAMP environments.
Citrix NetScaler ADC and Gateway instances were targeted by CVE-2026-19490, an authentication bypass disclosed on August 19, 2026. Exploitation began on September 3, a 15-day window that allowed for rapid weaponization following the publication of proof-of-concept code. Data from Previdian showed 10 attempts from six attacker IPs across four countries within 24 hours of the PoC release. Shadowserver telemetry indicated that over 22,000 ADC and 1,700 Gateway instances remained exposed, highlighting the scale of the risk.
These incidents reveal a clear pattern of exploitation window compression. AI-assisted tooling has significantly lowered the cost of reverse-engineering patches, allowing attackers to develop functional exploits faster than most enterprises can deploy updates. The gap between disclosure and active exploitation is shrinking, leaving little room for manual remediation cycles.
This crisis is exacerbated by how enterprise agents are deployed. Many operate under the assumption that the VPN gateway provides a trusted environment. These agents authenticate through VPN tunnels using static credentials, operating on the flawed premise that authenticated network access is equivalent to trusted access. In reality, VPNs grant broad, implicit access once the initial authentication is bypassed. While Zero Trust principles, as outlined in the CISA Zero Trust Maturity Model, were intended to replace these legacy VPN trust models, adoption remains incomplete.
For security practitioners, the path forward requires a shift in priorities. First, VPN infrastructure must be treated as the highest-priority patch surface, necessitating automated deployment pipelines to keep pace with compressed exploitation windows. Second, organizations must decouple agent authentication from the VPN gateway. Agents should be configured to require granular, per-API access controls that function independently of the underlying network transport. Relying on the VPN as a security boundary is no longer sufficient when the boundary itself is the primary point of failure.