Of the 255 vulnerabilities that CISA added to its catalog of Known Exploited Vulnerabilities between January 1 and October 8, 2026, 50 sit in network edge and perimeter products: firewalls, VPN and remote access gateways, load balancers, routers and SD-WAN controllers. That is roughly one in five entries, up from about one in seven in each of the two previous years.
The catalog is the list of flaws that US federal civilian agencies must fix by a set deadline, and it doubles as the industry's shortlist of what attackers use. The 255 entries added in a little over nine months of 2026 already exceed the 245 added in all of 2025, and the boxes between a network and the internet take a growing slice of that total.
How the count was made
The classification is an approximation based on vendor and product names. A narrow definition covering firewalls and their management servers, remote access and VPN appliances, load balancers, routers and their operating systems, SD-WAN components and mail gateways yields 50 entries, or 19.6 percent of the year's additions. A wider one, which also takes in switches, access control systems, device servers, remote support boxes and the sandbox and endpoint management servers sold by the same vendors, reaches 62, or 24.3 percent. By the narrow definition the share was 14.3 percent in 2025 (35 of 245 entries) and 13.4 percent in 2024 (25 of 186). Of the 50 entries in 2026, 42 carry 2026 CVE identifiers.
Cisco accounts for 15 of the 50, nine of them in Catalyst SD-WAN alone. Citrix NetScaler has six, Fortinet, Check Point and SonicWall four each, MikroTik and Ubiquiti three each. Microsoft still tops the catalog with 39 additions by October 8, but those are mostly Windows, Office and SharePoint flaws rather than perimeter devices. Google's threat intelligence group put edge and security appliances at 14 percent of the flaws exploited between January and August 2026, with over 65 percent of those rated high or critical risk, and named unauthenticated management interfaces as the usual way in.
Two weeks of appliance flaws
The pattern compressed into a fortnight between late September and early October. On September 27 CISA listed two Citrix NetScaler flaws, CVE-2026-88771 and CVE-2026-88772, both exploited before patches existed, among eight bugs Citrix fixed at once. On October 4 it added CVE-2026-88779, a memory handling bug attackers were using to crash appliances configured for SAML authentication, including appliances that administrators said had just been patched against the first two. Citrix shipped fixed builds on its 14.1 and 13.1 lines and pushed blocking signatures for known attacker addresses.
CISA listed CVE-2026-76504 in Catalyst SD-WAN Manager on September 30: a crafted URI encoding slips a request past the rule guarding an API endpoint and hands the caller admin rights. It was the fifth time in 2026 that a zero day in the product had been disclosed as exploited. Fixes cover releases 20.9 through 26.2; anything older than 20.9.10.1 has no patch and must be migrated. CISA gave agencies until October 3.
Fortinet published an advisory for CVE-2026-104286 in its FortiMail gateway on October 1 and said it was already being exploited. The bug chains a path traversal with a NULL byte so that an unauthenticated attacker can write arbitrary files over HTTP or HTTPS; it scores 9.8 and affects FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. As of October 2 the fixed versions 8.0.2, 7.6.7 and 7.4.9 had not shipped, so Fortinet told customers to disable identity based encryption or cut the management interface off from the internet. Fortinet listed no fix for the 7.2 branch and told those users to move to 7.4 or later.
SonicWall patched CVE-2026-102255, a maximum severity flaw in the WorkPlace interface of its SMA1000 remote access appliances, on October 6. Three days later researchers at Previdian and Defused reported exploitation attempts against their decoy appliances: requests that make the box call its own internal CouchDB service with default admin credentials. It was the third time in 2026 that SMA1000 flaws had drawn attacks, after zero days in July and September. Shadowserver counted more than 400 of the appliances exposed online.
Why appliances, and what to do
The appeal to attackers is structural. These devices face the internet by design, because terminating VPNs and filtering mail is their job. They run closed operating systems that accept no endpoint agent, so an intrusion produces none of the alerts a compromised laptop would. They hold exactly what an intruder wants next: session tokens, directory credentials, certificates and administrative access to everything behind them. And their patch cycles are slow, because an update means downtime on a device everyone depends on and older models often never get a fix. One Cisco IOS flaw added to the catalog in July 2026 dates from 2008.
The defensive answers follow from those traits. Management interfaces belong off the internet, reachable only from trusted internal addresses through a dedicated network or a jump host, as Cisco and Fortinet both advised in October. Patch windows for perimeter gear have to be measured in days, because the SMA1000 case shows probing within three days of a fix. Logs should leave the box in real time: Cisco and Fortinet published indicators that live in appliance log files, and Citrix ships a compromise checking script that runs on the box, all of which an intruder with root can tamper with. And end of life units need replacing: eight of the 50 edge entries added in 2026 carry CVE identifiers from earlier years, and the catalog's deadlines apply whether or not the vendor still ships fixes.
Of the 50 edge entries added in 2026, 43 came with a three day federal deadline, against 130 of the 255 additions overall. That is the window CISA sets for this class of device, and it is the one that anyone running an internet facing firewall, gateway or VPN appliance should plan around.
