The VPN gateway has become ransomware’s favorite front door. On October 19, 2026, Palo Alto Networks’ Unit 42 confirmed that the Qilin and Inc ransomware operations are exploiting CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass that was added to CISA’s Known Exploited Vulnerabilities catalog back on May 13, 2026, to open VPN sessions without valid MFA, then fan out with RMM tools, RDP, and SMB. CISA’s own edge device guidance puts it bluntly: firewalls, routers, and VPN gateways are “prime targets” because they sit on the public internet, and threat actors exploit “known vulnerabilities, weak default settings, and misconfigurations” in them to get in, move laterally, and persist. The good news is that most of the defense is disciplined, repeatable work. Here’s a step-by-step hardening checklist any tech can run against a client’s perimeter this week.
1. Build an Edge Inventory With End-of-Support Dates
You cannot harden what you have not found. CISA’s first “Identify” recommendation is to create and maintain an asset inventory that captures every edge device and its end-of-support (EOS) date, and its Binding Operational Directive 26-02, issued February 5, 2026, requires federal civilian agencies to inventory EOS edge devices and phase them out. Private shops should borrow the same discipline:
- What to capture: vendor, model, serial, firmware version, public IPs, exposed services, admin URL, owner, and EOS date
- Where to look: your RMM and documentation platform, firewall management consoles, ISP handoff paperwork, and an external scan of each client’s public IP ranges
- Shadow edge: forgotten branch firewalls, old SSL VPN appliances kept “just in case,” and ISP-supplied routers with remote management enabled
- Automate reminders: CISA recommends tracking upcoming EOS dates with automated reminders so replacements get budgeted before support ends
Anything already past EOS goes to the top of the replacement list. As CISA notes, EOS edge devices are “trivial” for attackers to exploit because they no longer receive security updates.
2. Patch on a KEV-Driven Clock, Not a Monthly One
Edge firmware cannot wait for the next maintenance window. The PAN-OS case shows why: Unit 42 says its investigations into CVE-2026-0257 activity have run since early June, and ransomware crews were still exploiting it in October, long after a fix shipped. Build a faster lane for perimeter gear:
- Subscribe to vendor PSIRT feeds: get advisories for every firewall and VPN vendor in your inventory by email or RSS
- Watch the CISA KEV catalog: treat any KEV entry that touches a device you manage as an emergency change
- Apply mitigations the same day: if the fix needs a reboot window, apply the vendor’s documented workaround immediately and schedule the upgrade
- Patch, then hunt: a patch closes the door but does not evict anyone who already walked through it (see step 6)
3. Get Management Interfaces Off the Internet
CISA’s guidance is to keep management interfaces off the public internet and disable risky and unnecessary services and ports. In practice, that means the admin web UI and SSH on a firewall should only answer from a dedicated management network or a jump host, never from the WAN. Check each device for:
- WAN-side admin access: HTTPS, SSH, Telnet, or SNMP management enabled on the untrusted interface
- Interface management profiles: on PAN-OS, review which profiles are attached to internet-facing interfaces, a step Unit 42 and Rapid7 both call out
- Unused features: legacy portals, clientless VPN, UPnP, and any service no one can justify
- Allow-lists: if remote admin is truly required, restrict it to known source IPs and require MFA
A quick external check from outside the client network confirms what is actually reachable. For example, from a cloud VM or an approved scanning host:
nmap -Pn -sV -p 22,23,80,443,4443,8443,10443 <client-public-ip>Only scan ranges you are authorized to test, and compare the results against what the client should be exposing.
4. Harden VPN Authentication and Session Settings
MFA on the VPN is mandatory, but CVE-2026-0257 proves it is not sufficient on its own. According to Rapid7’s analysis, affected devices had to have the authentication override (cookie) feature enabled on the portal or gateway and reuse the same certificate to encrypt and decrypt those cookies, which let attackers skip the normal login flow. Review the settings that sit around MFA, not just MFA itself:
- Phishing-resistant MFA: CISA recommends it for edge access; prefer FIDO2 or certificate-based methods over SMS or push approvals
- Cookie and token features: disable authentication override cookies and “remember me” style tokens where you can, and use unique certificates where you cannot
- Default and shared credentials: change every default account, remove shared admin logins, and give each tech a named account
- Session limits: set sensible idle timeouts and maximum session lifetimes so a stolen session does not live for days
- Credential storage: CISA’s June 2026 Fortinet alert urged admins to confirm strong credential hashing and remove weaker legacy hashes, a good check on any platform
5. Segment What the VPN Can Reach
Unit 42 describes the post-access playbook clearly: reconnaissance with dual-use RMM tools, lateral movement over RDP and SMB, credential harvesting, exfiltration, and ransomware. Segmentation turns a VPN compromise into a contained incident instead of a domain-wide outage. CISA likewise recommends isolating edge devices from critical systems.
- Role-based VPN access: map user groups to only the subnets and ports they need instead of a flat “VPN users can reach everything” rule
- Protect the crown jewels: block VPN pools from reaching hypervisor management, including vCenter and ESXi, backup servers, and domain controller admin ports unless a named admin group requires it
- Limit RDP and SMB: allow them only from jump hosts, and alert on VPN addresses touching many hosts in a short window
- Control RMM tools: allow only your sanctioned RMM and block or alert on others, since attackers lean on the same tools MSPs use
6. Log, Hunt, and Have an Incident Plan Ready
Hardening only works if you can see when it fails. Forward firewall and VPN logs to a SIEM or log platform with enough retention to look back months, not days. Unit 42’s threat brief offers a useful model of what to hunt for in VPN logs: successful gateway connections from unexpected IPs, and suspicious or placeholder host names and MAC addresses such as generic “DESKTOP” style device names or sequential MACs.
- Baseline normal: know which countries, ISPs, and device names your users normally connect from
- Alert on oddities: new device IDs, logins outside business hours, and connections that skip the expected MFA event
- After a patch: terminate active VPN sessions, reset VPN and admin credentials, and review access logs, steps CISA and Unit 42 both recommend after exposure
- Escalate fast: Unit 42 advises activating incident response for any successful suspicious gateway connection, so have the IR contacts and runbook ready before you need them
Looking Ahead
Edge devices will keep drawing fire because they are reachable from anywhere and wired straight into identity systems. CISA is pushing organizations to replace EOS gear and to buy from vendors that follow Secure by Design principles, including better logging and forensics support, and those criteria belong in every firewall and VPN refresh conversation with clients.
For working techs, the practical takeaway is to make this checklist a recurring task rather than a one-time cleanup: re-run the inventory quarterly, review exposure after every firmware upgrade, and treat each new KEV entry for a perimeter device as a same-day change. The teams that do the boring work consistently are the ones that end up reading about the next VPN zero-day instead of living through it.
Sources:
- Palo Alto Networks Unit 42, October 19, 2026
- Rapid7, 2026
- CISA, Edge Device Security, 2026
- CISA, BOD 26-02, February 5, 2026
- CISA, June 18, 2026
