VPNs, Email Gateways and Remote-Support Tools: The Edge Devices Exploited This Month, and What to Check Now

In October 2026, flaws in devices that sit at the edge of a network, such as VPNs, firewalls, email gateways and remote-support tools, have been exploited one after another. In the CISA KEV (the catalog of Known Exploited Vulnerabilities), the version published at 19:30 UTC on October 23 has 26 vulnerabilities with an added date between October 1 and October 23 (I counted these from the added dates in that data). They include products from Ivanti, Citrix, Palo Alto Networks, Cisco, Fortinet, BeyondTrust, Arista and, in Japan, SiteGuard.

This article is for executives and the people who run IT. Built around vendor advisories and CISA’s statements, it covers which devices are affected, what to do before updating, and why updating alone is not enough. Sources are cited next to each statement. The information is current as of October 25, 2026 JST.

Key points

• At least nine edge products were confirmed exploited this month (see the table below). All of them are in the CISA KEV.
• Ivanti, BeyondTrust and Citrix were exploited before fixes were available. If an attacker got in before you updated, updating does not remove the compromise.
• CISA asks for a check for compromise (forensic triage) and for evidence to be preserved before updating, because updating can destroy evidence.
• The Digital Agency incident, in which about 246,000 people’s information may have leaked, also started with a VPN device vulnerability.
• The first thing to do now is list your edge devices and check whether any of the products confirmed exploited are among them.

Edge devices confirmed exploited this month

This is a summary based on CISA’s KEV descriptions and each vendor’s advisory. “KEV added” is the date the entry was added to the KEV. Always confirm the fixed version numbers in each vendor’s advisory.

On Ivanti, BleepingComputer reports that Volexity said an actor it tracks as UTA0576 had been chaining this flaw with two others since October 3 (Defused says it saw the first signs on October 1). The actor reportedly dropped no malware and no web shell, re-exploited the device for each command, and tampered with logs, so Ivanti’s Integrity Checker Tool (ICT) did not detect it. One of the chained flaws (a privilege escalation) was unpatched at the time of the report. I could not retrieve Ivanti’s own page, so this part rests on the press report.

On BeyondTrust, Rapid7 says BeyondTrust dates two compromises to August 29, before its October 15 disclosure. Mandiant ties the activity to a suspected PRC-nexus espionage actor.

A case in Japan: the Digital Agency’s Government Solution Service

The same kind of intrusion has happened in Japan. On September 11, the Digital Agency announced that unauthorized access to the Government Solution Service (GSS) may have leaked the personal information of about 246,000 people.

• June 25: a large number of file accesses through a maintenance and operations account was detected
• July 9: it was found that a third party had broken in through a VPN device vulnerability. The same day, the account was suspended and the compromised device’s external communications were cut
• September 11: announced publicly
• What may have leaked: about 246,000 people (about 189,000 staff of government agencies and related public officials, and about 57,000 business operators and individuals). Names about 236,000, email addresses about 231,000, phone numbers about 94,000, street addresses about 1,000 (records may overlap). My Number, bank account information and pension numbers were not included
• Secondary harm: none confirmed

From detection to announcement was 78 days (June 25 to September 11, my own calculation). The Digital Agency lists a review of how it manages vulnerabilities and better ways of connecting externally among its prevention steps.

Separately, in the National Police Agency’s first-half 2026 summary, ransomware reports numbered 123, the most for any half-year since statistics began in 2020 (@IT, a press report; I have not checked the NPA original).

Why updating alone is not enough

These three points are my own observations.

• Edge devices face the internet directly, so attackers find them first. In this October’s examples, Ivanti and BeyondTrust were exploited before fixes existed.
• It is hard to run endpoint detection software on edge devices, and the logs inside them are sparse and overwritten quickly. A break-in is easy to miss.
• An update closes the vulnerability inside the device, but it does not remove a foothold that was already planted. Rapid7 also says persistence can remain after patching.

In its Citrix alert, CISA lays out these steps. Before updating, check for signs of compromise, and if compromise is suspected, preserve forensic evidence before updating, because an update can reduce what is available to investigate. Then restore a known-good backup from before any compromise and rotate every stored secret (account passwords, key-encryption keys and SSL certificates). Forward logs to a SIEM outside the device, because logs on the device can rotate quickly.

The directive for US federal agencies, BOD 26-04 (June 10, 2026), likewise requires that, for items marked for forensic triage, remediation and a check for compromise both be completed within three days. The directive covers federal agencies, but the thinking is useful for private companies too.

What to check now

Today

1. List your edge devices: VPNs, firewalls, email gateways, load balancers, remote-support tools, SD-WAN management systems and backup consoles, anything reachable from the internet. CISA defines edge devices as devices on the network boundary that are reachable from the public internet (BOD 26-02)
2. For each device, write down the product and version, and check whether any product in the table above is on the list
3. If one is, preserve logs and diagnostic information before updating. For example, SiteGuard asks you to download and keep the “diagnostic information” from the admin console before updating. Arista asks you to preserve logs and file timestamps if compromise is suspected

This week

4. Update. Confirm the fixed version numbers in each vendor’s advisory
5. After updating, check for compromise. For Citrix, CISA describes running the IOCs provided in NetScaler Console to look for signs. As the report above shows, Ivanti’s integrity checker has been evaded, so do not rely on it alone
6. Check that your admin interfaces are not exposed to the internet. Palo Alto says restricting management access to trusted internal addresses or a single jump box lowers the risk
7. Forward the logs from your edge devices to a location outside the devices

This month

8. Review the privileges and monitoring of maintenance accounts. In the Digital Agency incident, bulk file access through a maintenance and operations account is what triggered detection
9. Bring your vendor-notification contacts up to date. SiteGuard notified customers with a support contract individually on September 29, about two weeks before the public announcement. If the contact on your contract or maintenance agreement is stale, that notice will not reach you
10. Decide who updates edge devices and how often. Replace devices that are out of support

What I could not confirm

• I could not retrieve the official advisories for Ivanti and BeyondTrust. The finer points for these two products rest on press reports and Rapid7’s analysis
• I could not retrieve Citrix’s fixed version numbers, so I have not listed them
• I could not check the National Police Agency original. The figure rests on a press report

Related articles

• Two Critical GitLab Flaws, Not One: Why the October 12 Fix Is Not Enough: GitLab, run on your own servers, also entered KEV this month. Updating may not fix it
• The Brotli Vulnerability Is Not Just a Node.js Problem: Where to Check and What Is Known About Exploitation: The Brotli flaw that entered KEV on October 27: where to check, and what is known about exploitation
• An Adobe Commerce and Magento Flaw Joins CISA’s Exploited List: Fixed in July, Attacked Since March, and What to Check: Another platform added to KEV this month: the Adobe Commerce and Magento flaw, and where to check
• Earning Cybersecurity Certifications in the US, Stage by Stage: Exams, Exam Fees and Study Costs (October 2026): Certifications for work that protects edge devices: US exams by stage, with costs

If you need help taking stock of your edge devices, updating them or checking for compromise, get in touch below.