Another week, another round of VPN CVEs — and the coverage of these VPN security vulnerabilities follows the same script every time. Cisco ASA and FTD (Firepower Threat Defense) got a memory-exhaustion flaw in their SSL VPN service. Check Point patched an IKEv1 authentication bypass that attackers were already using to get into Remote Access VPN sessions without a password — one confirmed case ended in a Qilin ransomware affiliate sitting inside the network. Palo Alto disclosed a GlobalProtect cookie-forgery bug that let unauthenticated attackers mint their own login tokens. Microsoft shipped a RasMan fix after attackers were caught crashing Windows VPN services in the wild.
Each one gets covered the same way: CVE number, CVSS score, “patch immediately.” Then the next one shows up and the cycle resets.
Each disclosure on its own isn’t wrong to cover. It’s just missing the forest for the trees. Treating every advisory as its own isolated fire misses the thing the data is actually showing: this is not a patching problem. It’s an architectural one, and it’s getting worse on schedule, every year, regardless of which vendor’s logo is on the box.
The VPN security vulnerabilities stat nobody’s arguing with
Verizon’s 2026 DBIR found that vulnerability exploitation overtook stolen credentials as the single most common initial access vector for the first time in the report’s 19-year history — 31% of breaches started with a software vulnerability, versus 13% for credential abuse. That builds on a trend the prior year’s 2025 DBIR had already flagged: edge devices and VPN appliances specifically jumped from 3% to 22% of exploitation-driven breaches — roughly an eightfold increase in a single year. Mandiant’s M-Trends 2026, built on over 450,000 hours of incident response, landed on a similar conclusion from a completely different dataset: exploits at 32% of initial access, edge devices and VPN gear leading the target list.
On the ransomware side, the picture is sharper. Coalition’s 2025 Cyber Claims Report found VPN compromise behind 73% of ransomware intrusions where the entry vector was identified — up from 38% in 2023. Mandiant separately found that in a third of the ransomware incidents it investigated in 2025, the initial foothold traced back to exploitation of a VPN or firewall.
None of this is one bad vendor having a rough year. Cisco, Check Point, Palo Alto, Fortinet, and Ivanti have all had critical, unauthenticated, remotely exploitable VPN flaws in the last twelve months. The common denominator isn’t the vendor. It’s the architecture.
Why can’t patching win this race
The part that rarely makes it into the headline is the timeline. Mandiant’s mean time-to-exploit in 2025 was negative seven days — meaning attackers were, on average, exploiting flaws before they were even publicly disclosed. CrowdStrike found 42% of exploited vulnerabilities were attacked before public disclosure. Meanwhile, the 2026 DBIR found that only 26% of critical vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated in 2025 — down from 38% the year before. Remediation is getting slower as exploitation gets faster.
Read those two numbers together and the “patch faster” advice stops making sense. You cannot out-patch an attacker who’s already inside before your CVE even has a number.
The design flaw underneath the CVE list
Every one of the CVEs above — the memory exhaustion, the cert-reuse cookie forgery, the IKEv1 auth bypass — is a different bug hitting the same design decision: a VPN has to expose an internet-facing listener that authenticates before it knows anything about who’s connecting. That listener is the whole attack surface. It doesn’t matter how good the crypto is behind it if the front door itself can be tricked, crashed, or walked through.
And critically, a successful bypass doesn’t just get an attacker “in.” VPNs were built to grant broad network access once authentication succeeds — that’s the entire point of the tunnel. So the actual damage from these CVEs isn’t the initial compromise; it’s what happens next, when the attacker who forged a cookie or skipped authentication has the same lateral reach as a legitimate remote employee. The headlines cover the door. They rarely mention what’s on the other side of it.
What the pattern actually calls for
This is the part most coverage skips entirely: the fix isn’t a better VPN. It’s removing the assumption that authentication success should equal network access. A model built on zero inbound ports and per-session, per-resource verification doesn’t have a comparable “cookie forgery gets you onto the network” failure mode, because there’s no broad network to land on in the first place. The access is scoped to the resource, continuously verified, not granted wholesale at the tunnel.
That’s the case for ZTNA as the model that actually makes sense going forward: not because it’s the newer buzzword, but because it removes the specific failure mode every CVE above depends on — a single authentication event that, once bypassed, hands over broad network access. Verizon, Mandiant, and Coalition are independently converging on the same data: VPN security vulnerabilities are not slowing down, and the exploitation curve is not going to flatten on its own. The architecture has to change, not just the patch cadence.
