Firewall, VPN and Mail Gateway: Why Perimeter Devices Are an Important Entry Point and How Small Businesses Keep Them Current

In September 2026, within two weeks, the US cybersecurity agency CISA added four critical flaws in firewalls, VPN gateways and mail gateways to its Known Exploited Vulnerabilities (KEV) catalog: Cisco Secure Firewall Management Center, Cisco Secure Email Gateway, F5 BIG-IP APM and Check Point's management software. All four carry a CVSS score of 9.8 or 10.0, and all four carry a forensic triage requirement in the KEV catalog. October brought Ivanti Connect Secure, Palo Alto PAN-OS, Fortinet and Cisco again.

These are not problems reserved for large corporations. The firewall of a trade business in Recklinghausen usually sits on the internet with a public IP address just like a corporate one; the difference is whether anyone watches it full-time. Below I put the cases in context and describe the patch process I recommend to small businesses in the Ruhr area.

Note: As of 3 November 2026. This article is not legal advice and does not replace a check of your specific devices. The security advisories of the respective vendors are authoritative.

Which perimeter flaws were exploited in autumn 2026?

Four cases from September, each with a three-day due date in the KEV catalog:

Three patterns sit inside these cases, and each hits small businesses differently:

• The patch had been available for a long time. Cisco published its advisory for the Firewall Management Center on 4 March 2026. Only in August, around five months later, did Cisco become aware of active exploitation. According to Cisco there is no workaround.
• The attack came before the patch. According to its advisory of 22 September 2026, Check Point observed a handful of pinpointed attacks on its management software on 23 July 2026; the fix arrived on the day of the advisory, around two months later.
• The patch was there, the attackers were faster. For the second Check Point flaw, CVE-2026-85102 in VPN certificate validation, the fix had been available since 9 September 2026. From 12 September, three days later, Check Point saw a wave of exploitation attempts against customers with Spark firewalls. Check whether your path from the vendor newsletter to a maintenance window is faster than that.

On 13 October 2026 CISA warned about an exploited flaw in Ivanti Connect Secure and added two more on 30 October. On 14 October, Palo Alto PAN-OS and, once again, Cisco Secure Email Gateway followed. By my own count of the KEV feed as of 30 October 2026, CISA added 36 vulnerabilities in October and 43 in September, 282 since the start of the year; nine of the October entries concern Fortinet, Citrix, Ivanti, Palo Alto or Cisco.

Why do attackers target the firewall and VPN rather than your PCs?

Because they are reachable from outside and usually lack the protective software that reports attacks on PCs. In its 2025 state of IT security report (reporting period 1 July 2024 to 30 June 2025, in German), Germany's Federal Office for Information Security (BSI) calls vulnerabilities in perimeter systems "an important entry point for cyberattacks", as in the years before. In its conclusion the BSI is blunter: "For example, known vulnerabilities in perimeter systems are patched far too late or not at all, far too often."

According to the M-Trends 2026 report by Google Mandiant, based on over 500,000 hours of incident investigations worldwide in 2025, exploitation of vulnerabilities was the most common initial access vector for the sixth year in a row and accounted for 32 percent of the intrusions examined. Mandiant describes threat groups that deliberately go after VPN devices and routers because the usual endpoint telemetry is missing there. The Five Eyes cybersecurity agencies call edge devices a preferred target for many threat actors, including state-sponsored ones, in their guidance from February 2025. Where such access leads is shown in the ransomware threat picture on Qilin: manufacturing and construction, typical Ruhr area businesses, were in its sights.

Is installing the update enough?

No, after an attack the update alone is not enough. The BSI puts it this way in its chapter on perimeter systems (in German): "In cases of vulnerability exploitation, patching alone is therefore usually not sufficient to operate devices securely again." The reason is in the same chapter: on Fortinet firewalls, attackers had secured persistent read access through older flaws, which "remained even after security patches were installed".

CISA says the same about Ivanti Connect Secure in practical terms: the vendor's integrity checker may not detect exploitation of the flaw first reported in October because the attackers' commands run only in memory. If a compromise is suspected, the recommendation is a factory reset, an update to the current version, then new passwords for all accounts including domain and administrator accounts, plus new certificates and API keys. Two things keep you able to act: a current backup of the device configuration and a tested backup of your data, as described in the 3-2-1 backup strategy.

A second BSI finding from the same chapter is particularly valuable for small businesses: firewall operators were less often affected when management access was restricted to trusted sources. An admin interface reachable only from the internal network or via VPN also defuses zero-days like the Check Point case.

How fast must an update go onto the firewall?

My benchmark: 72 hours, as soon as the device is reachable from outside and the flaw is listed in the KEV catalog. CISA's Binding Operational Directive BOD 26-04 of 10 June 2026 provides that US federal agencies remediate or mitigate flaws in publicly exposed systems with total technical impact and automatable exploitation within three days and, in addition, triage the device forensically. Agencies must meet this deadline from 7 December 2026 at the latest; in the KEV catalog, all four September cases already carry it today. The predecessor rule BOD 22-01 from 2021 had by default allowed two weeks (and six months for flaws with a CVE number assigned before 2021); it has been revoked.

For you as a business this is not an obligation, but a useful reference point: if CISA gives federal agencies three days, a maintenance window "sometime next month" is too slow for a device on the internet. For flaws without a KEV entry and for devices without internet exposure, a fixed, regular maintenance window is sufficient in my view.

Which patch process suits a small business?

Six building blocks that are sustainable without an in-house IT department:

1. Inventory of devices with internet exposure. Firewall, VPN gateway, mail gateway, remote maintenance access, NAS with port forwarding, self-hosted applications. Per device: vendor, model, firmware version, end of support, responsible person.
2. Subscribe to three information sources. The security advisories of every vendor in the inventory, the WID portal of CERT-Bund, which according to the BSI reports patches for over 1,500 products daily, and the CISA KEV catalog, available as an email subscription, CSV and JSON. Rule: if a product from the inventory appears in the KEV, the 72-hour clock starts.
3. Close management access. Admin interface and SSH not reachable from the internet, only from the internal network or via VPN with a second factor.
4. Define a maintenance window and a way back. Firmware updates reboot the device. Clarify in advance when that works for the business, who backs up the configuration beforehand and how you roll back if the update fails. The Five Eyes guidance recommends testing updates on a standby or test device first where possible; what downtime costs is shown by my downtime cost calculator.
5. Check for compromise after every KEV case. Unknown admin accounts, new VPN users, logins from foreign countries, the vendor's checking tools and indicators. If you suspect a compromise, follow the vendor: for Ivanti Connect Secure, CISA lists factory reset, update and new credentials; for physical Secure Email Gateways, Cisco refers you to its support and, for virtual ones, strongly recommends preserving forensic data first.
6. Tighten the contract with your IT provider. Who reads the advisories? How quickly is a KEV entry acted on? May the provider reboot outside business hours? Is every update logged? You need those logs anyway, because cyber insurers ask about the patch routine.

Questions about firewall updates in the business

Our provider says the firewall updates itself automatically. Is that enough?
Automatic firmware updates are a good start, but they do not answer whether management access is reachable from the internet, who checks for compromise after a KEV entry and whether the device still receives updates at all. Ask for the installed version and the end-of-support date.

How do I know whether our device is affected?
Compare the model and firmware version from the inventory with the vendor's advisory; it lists the affected and the fixed versions. In the KEV catalog you can filter by vendor name.

What about an old device that no longer receives updates?
The BSI describes that a considerable share of perimeter systems on the internet remains vulnerable through old flaws because operators take no action. A device without vendor support should be replaced, not managed. Until then: close management access and switch off unneeded services.

We use Microsoft 365 and hardly have any servers left. Does this still affect us?
Yes, as soon as a router, a firewall or a VPN access belongs to your site. The vendor patches the cloud services, not the device at your internet connection.

Would you like to know whether your firewall, VPN and mail gateway are up to date today? Then let's go through the inventory, the advisories and the management access together. More on this in my IT support for businesses in Recklinghausen and the Ruhr area.

Related service: IT support and managed services

Note: The articles on this blog are produced with the help of AI and are editorially reviewed before publication. Editorial responsibility lies with Emre Yurtbay (see the legal notice).