watchTowr has documented two remote-code-execution zero-days in Citrix NetScaler ADC and Gateway, already exploited before any fix existed. With nothing published by Citrix, the only defense is isolation: preserve evidence, cut the appliance off the network and keep management off the internet.
On September 22, 2026, Check Point published an “Action Required” advisory confirming in-the-wild exploitation of two CVSS 9.8 vulnerabilities: CVE-2026-85102 in the Security Gateway VPN and the zero-day CVE-2026-93616 in the Management server. Apply the fixes immediately and hunt for anomalous Mobile Access logins.
On September 9, 2026, Check Point fixed two CVSS 9.8 flaws in how its firewalls and management console validate and decode VPN certificates, both exploitable without authentication for remote code execution. The Dutch NCSC says exploitation is imminent: apply the Live Patch or the Jumbo Hotfix now.
On August 31, 2026, Brad Fitzpatrick released tailcat, an open-source Go package and CLI that exposes Tailscale’s data plane — WireGuard, NAT traversal, and DERP — with no account, no IP addresses, and no control plane. Use it to connect two isolated machines, or hand an AI agent a disposable connection, with no root access.
On August 19, 2026, Cloud Software Group published a bulletin for NetScaler ADC and NetScaler Gateway: CVE-2026-19490, a CVSS 9.3 authentication bypass exploitable remotely without credentials, and CVE-2026-19489, an 8.8 denial-of-service. Any internet-facing appliance needs an emergency upgrade, after triage driven by the SAML or vserver configuration.
Two flaws in SonicWall SMA 1000 VPN gateways — a CVSS 10 SSRF and a code injection — were exploited as zero-days by INC Ransomware from July 2026. Applying the patch is necessary but not sufficient: attackers roll vulnerable firmware back to keep their foothold.
CISA added CVE-2026-33824, a remote code execution flaw in Windows IKE, to its Known Exploited Vulnerabilities catalog on August 18, 2026 — four months after Microsoft shipped the fix. Network teams must patch exposed IPsec gateways or block inbound UDP 500 and 4500 now.
An Akira ransomware affiliate got initial access through a SonicWall VPN with no MFA, then rebooted the box into Safe Mode to neutralize EDR while exfiltrating. Huntress’s account shows an EDR is no safety net once an attacker holds valid credentials.
On August 13, 2026 AWS shipped version 6.0 of its VPN client, rebuilt on OpenVPN3 with a full CLI and centralized administrative controls. Teams automating remote access can now script connections without third-party tooling.
WireGuard has been in the Linux kernel since March 2020, Tailscale crossed $100M ARR in early 2026, and Headscale has passed 42,000 GitHub stars. If you self-host more than two services, a free or self-controlled mesh VPN transforms remote access without a single firewall rule.
NIST published SP 800-207 in August 2020, the Biden administration mandated Zero Trust for all US federal agencies in January 2022, and Google has been running BeyondCorp internally since 2011 without a VPN. If your network security still relies on the assumption that a packet is clean because it originated on the LAN, you have already lost.
