On October 25, 2026, researcher Erica Windisch published Tailworm, a report showing that Tailscale SSH combined with port forwarding grants root access to every reachable server once a single device on the mesh is compromised. With no patch and no CVE so far, the immediate fix comes down to three settings: pairwise access rules, port forwarding off, and Tailnet Lock.
On October 20, 2026, Unit 42 confirmed that the Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) ransomware groups are still exploiting CVE-2026-0257, the GlobalProtect authentication bypass that has been patched since May. If you run an exposed PAN-OS gateway, check your version and disable authentication override now.
On 15 October 2026, Check Point confirms that CVE-2026-85102, a pre-authentication remote code execution flaw in its Security Gateway VPN fixed on 9 September, is now being exploited at scale against Spark firewalls, and ships a fix for a zero-day in its management server. Apply both hotfixes, starting with your management servers, which are watched less closely than the gateways.
On October 13, 2026, Ivanti patched CVE-2026-104935, an authentication bypass exploited as a zero-day on its Connect Secure VPN gateways, which Volexity ties to a three-flaw chain ending in root. The compromise leaves nothing the vendor’s integrity tool can see: patch on an emergency basis and verify every appliance forensically.
Headplane, spotlighted by selfh.st on October 9, 2026, adds to Headscale — the open-source reimplementation of Tailscale’s control server — a web interface with OIDC single sign-on, remote SSH, and tailnet settings management. It is the missing piece for self-hosting your own mesh network without giving up usability.
On October 6, 2026, the FBI and Secret Service confirmed that the FortiBleed campaign has compromised more than 86,644 internet-facing Fortinet devices across 194 countries by reusing stolen credentials and cracking passwords on a GPU cluster. There is nothing to patch: the fix is MFA, PBKDF2 hashing and pulling firewall administration off the internet.
SonicWall patched a pre-authentication SSRF (CVE-2026-102255, CVSS 10.0) in its SMA 1000 appliances on 6 October 2026; since 8 October, researchers have logged 135 exploitation attempts. If you run an internet-facing SMA 1000, apply hotfix 12.4.3-03670 or 12.5.0-03082 and hunt for web shells.
FatPipe MPVPN, WARP and IPVPN appliances on the end-of-life 10.1.2r60p100 firmware expose an OS command injection and a stack buffer overflow that both yield an unauthenticated root shell. Move to a supported release and lock down the management interface, which ships disabled by default.
watchTowr has documented two remote-code-execution zero-days in Citrix NetScaler ADC and Gateway, already exploited before any fix existed. With nothing published by Citrix, the only defense is isolation: preserve evidence, cut the appliance off the network and keep management off the internet.
On September 22, 2026, Check Point published an “Action Required” advisory confirming in-the-wild exploitation of two CVSS 9.8 vulnerabilities: CVE-2026-85102 in the Security Gateway VPN and the zero-day CVE-2026-93616 in the Management server. Apply the fixes immediately and hunt for anomalous Mobile Access logins.
On September 9, 2026, Check Point fixed two CVSS 9.8 flaws in how its firewalls and management console validate and decode VPN certificates, both exploitable without authentication for remote code execution. The Dutch NCSC says exploitation is imminent: apply the Live Patch or the Jumbo Hotfix now.
On August 31, 2026, Brad Fitzpatrick released tailcat, an open-source Go package and CLI that exposes Tailscale’s data plane — WireGuard, NAT traversal, and DERP — with no account, no IP addresses, and no control plane. Use it to connect two isolated machines, or hand an AI agent a disposable connection, with no root access.
On August 19, 2026, Cloud Software Group published a bulletin for NetScaler ADC and NetScaler Gateway: CVE-2026-19490, a CVSS 9.3 authentication bypass exploitable remotely without credentials, and CVE-2026-19489, an 8.8 denial-of-service. Any internet-facing appliance needs an emergency upgrade, after triage driven by the SAML or vserver configuration.
Two flaws in SonicWall SMA 1000 VPN gateways — a CVSS 10 SSRF and a code injection — were exploited as zero-days by INC Ransomware from July 2026. Applying the patch is necessary but not sufficient: attackers roll vulnerable firmware back to keep their foothold.
CISA added CVE-2026-33824, a remote code execution flaw in Windows IKE, to its Known Exploited Vulnerabilities catalog on August 18, 2026 — four months after Microsoft shipped the fix. Network teams must patch exposed IPsec gateways or block inbound UDP 500 and 4500 now.
An Akira ransomware affiliate got initial access through a SonicWall VPN with no MFA, then rebooted the box into Safe Mode to neutralize EDR while exfiltrating. Huntress’s account shows an EDR is no safety net once an attacker holds valid credentials.
On August 13, 2026 AWS shipped version 6.0 of its VPN client, rebuilt on OpenVPN3 with a full CLI and centralized administrative controls. Teams automating remote access can now script connections without third-party tooling.
WireGuard has been in the Linux kernel since March 2020, Tailscale crossed $100M ARR in early 2026, and Headscale has passed 42,000 GitHub stars. If you self-host more than two services, a free or self-controlled mesh VPN transforms remote access without a single firewall rule.
NIST published SP 800-207 in August 2020, the Biden administration mandated Zero Trust for all US federal agencies in January 2022, and Google has been running BeyondCorp internally since 2011 without a VPN. If your network security still relies on the assumption that a packet is clean because it originated on the LAN, you have already lost.
