KEV · patch order
Thirteen of thirty-eight rows are boxes at the edge.
VPN concentrators, firewalls, mail gateways, remote-support portals. They are a third of the working set, and seven of them need nothing from the attacker but a network path.
What the working set shows
We tagged each row in the working set by where the product sits. Thirteen are perimeter appliances: things that are reachable from the internet because that is their job. Here they are, grouped by product.
| Product | Rows | Precondition in the class line |
|---|---|---|
| Ivanti Connect Secure | 3 | None for one, an account for one, local access for one |
| Cisco Secure Email Gateway | 2 | None for both |
| Fortinet FortiOS and FortiMail | 2 | Admin account for FortiOS, none for FortiMail |
| Citrix NetScaler ADC and Gateway | 1 | None |
| Cisco Secure Firewall ASA and FTD | 1 | None. The impact is a crash |
| BeyondTrust Remote Support | 1 | None |
| Palo Alto Networks PAN-OS | 1 | An account |
| SonicWall SonicOS SSLVPN | 1 | An alternate credential |
| Arista VeloCloud Orchestrator | 1 | Not stated |
Ten of the thirteen carry the forensic triage flag. CISA is saying that patching is not the end of the job for these.
Why the edge, again
This is not a fact about 2026. It is how these boxes are built and run.
- They are reachable by design. A VPN gateway that only answered the LAN would be useless. Every scanner on the internet sees it on day zero.
- They rarely run your endpoint agent. Most are vendor-sealed. What happens on them is visible only through their own logs.
- Their logs live on the box. If you do not forward them, the first person with root decides what you get to read. The VMware ESX row in this set (CVE-2026-41709) is about admin operations missing from the log. That is the same problem from a different angle.
- They hold keys. Directory bind accounts, session cookies for every VPN user, TLS private keys, sometimes cached passwords. An attacker on the gateway is close to everything behind it.
- They patch like firmware. A reboot window, a change ticket, sometimes a vendor support call. That delay is the gap the catalog keeps landing in.
A patch order that survives a bad week
When three advisories land in the same week, people patch in the order the emails arrived. Do it in this order instead.
- Internet-reachable, nothing needed from the attacker, triage flag set. Patch now and plan the compromise check in the same change.
- Internet-reachable, needs an account. Credentials are cheap: reuse, phishing, a contractor's laptop. The SonicWall row needs a second valid credential, and that is not a high bar.
- Management planes: firewall managers, orchestrators, hypervisor consoles. One of them hands over the fleet.
- Internal server applications, ordered by who can reach them.
- Clients and libraries, through the normal update channel, with the build confirmed on the device.
Before any of that
If a management interface answers from the internet, closing it is faster than any patch and it removes a whole class of rows. Admin portals belong on a management network or behind a separate VPN, not on the address users connect to.
Same product, again
Ivanti Connect Secure has three rows added between 13 and 30 October. Cisco Secure Email Gateway has two, a month apart. When a product shows up twice, stop treating it as an incident and start treating it as a standing item:
- Someone owns the vendor's security advisory feed for that product and reads it the day it changes.
- The upgrade path is tested, including rollback, before the next advisory.
- You know who can approve a reboot outside business hours.
- The device's logs already go to a collector, so the next look-back does not start with "the logs rotated".
- You have asked whether this box still needs to face the internet, or whether a different access model would remove it.
After the patch
A patched gateway can still hold a web shell, a new admin account, or a stolen session database. The look-back is in Patched is not the same as clean. The scoring side, and why CVSS alone would have put several of these rows lower, is in CVSS, EPSS and KEV answer three different questions.