Security Best Practices, Inc.
← All insights

Network Security3 min read

Your Firewall Is the Front Door: Lessons from 2026's Edge-Device Attacks

From 600+ firewalls breached with nothing more than weak passwords to VPN zero-days exploited by ransomware crews, 2026 has shown that edge devices are attackers' favorite way in. Here's how to harden yours.

By Keith W. Salustro, CISSP

Firewalls and VPN gateways exist to keep attackers out. In 2026, they have repeatedly been the way attackers got in.

The incidents fall into two categories. Some were caused by basic configuration hygiene that was never done. Others exploited vulnerabilities in the devices themselves. Both have the same result: an attacker standing on the most trusted device in your network, one step away from your domain controllers and backups.

Lesson 1: Attackers don't need a zero-day if your management interface is exposed

Between January and February 2026, a financially motivated threat actor compromised more than 600 FortiGate firewalls across over 55 countries, according to Amazon's threat intelligence team. The attacker used no vulnerability. They scanned the internet for management interfaces exposed on common ports such as 443, 8443, 10443 and 4443, then logged in with weak or reused credentials protected by a single factor.

What happened next is the part every IT leader should read twice. Once inside, the attacker:

  • pulled Active Directory credential databases,
  • moved laterally with stolen hashes and tickets, and
  • went after backup servers specifically, to disable recovery before a likely ransomware deployment.

The attacker also used commercial AI tools to plan the campaign and write tooling. That's a reminder that the skill required to run attacks at this scale keeps dropping.

The takeaway: This wasn't a Fortinet problem. It was a configuration problem that exists on every brand of firewall. If your admin interface is reachable from the internet with only a password, you are relying on that password alone to stop a determined, automated attacker.

Lesson 2: When the vulnerability is in the device, speed matters

Even a well-configured firewall can't protect you from flaws in its own code, and 2026 has been relentless:

  • Check Point remote access VPN (CVE-2026-50751). An authentication bypass let unauthenticated attackers establish VPN sessions on gateways still using the deprecated IKEv1 protocol. Exploitation began May 7, a month before the June 8 advisory, and at least one case was tied to a Qilin ransomware affiliate. CISA gave federal agencies three days to patch.
  • Citrix NetScaler ADC and Gateway (September 2026). Two critical zero-days allowing remote code execution were actively exploited globally. CISA advised organizations to check for signs of compromise before patching, because updating can erase forensic evidence.

Two patterns stand out. First, attackers often exploit these flaws for weeks before a fix exists. Second, a legacy feature that nobody remembered was enabled, such as IKEv1, can turn a vendor bug into your breach.

Your edge-device hardening checklist

  1. Take management off the internet. Admin interfaces should be reachable only from a dedicated management network, a jump host or a ZTNA connection. Never expose them on the public WAN interface.
  2. Require MFA for every admin and VPN login. Phishing-resistant methods are best. Disable or tightly restrict local accounts, and rotate any default or shared credentials.
  3. Inventory every edge device. That includes firewalls, VPN concentrators, load balancers and remote access gateways, with model, firmware version and end-of-support date. You can't patch what you don't know about.
  4. Treat actively exploited edge bugs as emergencies. Subscribe to vendor advisories and the CISA KEV catalog. Have a pre-approved process to patch or mitigate internet-facing devices within 72 hours.
  5. Hunt before you patch. When a zero-day drops, check logs and indicators of compromise first and preserve evidence. Patching a device that's already compromised doesn't remove the attacker.
  6. Turn off what you don't use. Disable legacy protocols (IKEv1, old TLS versions), unused VPN portals and services, disable and delete old accounts. Every enabled feature is extra attack surface.
  7. Send firewall logs somewhere attackers can't erase them. Forward admin logins, configuration changes and VPN authentications to a SIEM or log service, and alert on logins from unusual locations.
  8. Assume the edge will fail, and protect what's behind it. Segment and isolate backup infrastructure, keep immutable or offline copies, and make sure domain admin credentials are never used from the firewall's network segment.
  9. Review firewall rules regularly. Old "temporary" rules and overly broad any-any rules quietly undo good architecture.
  10. Plan your path beyond the traditional VPN. Zero Trust Network Access (ZTNA) and SASE can significantly reduce how much of your network is exposed to the internet in the first place.

The bottom line

The 2026 edge-device attacks didn't require exotic techniques. Most of the damage came from exposed management interfaces, single-factor passwords, slow patching and legacy features left switched on. These are fixable problems, and fixing them makes your firewall the barrier it was supposed to be.

Security Best Practices has designed and supported enterprise firewalls and remote access for more than two decades. If you'd like an independent review of your firewall configuration and edge exposure, get in touch.