On 14 July 2026, SonicWall rushed out fixes for two VPN vulnerabilities in its SMA 1000 remote-access appliances that attackers were already exploiting, and the US cybersecurity agency (CISA) gave federal agencies three days to patch them. It is not an isolated case: the company VPN, the box that lets people work remotely, has become one of the main ways attacks get in. Your remote access is not a risk in itself; it becomes one when it stays exposed to the whole Internet, falls behind on updates or is protected by a password alone.
Key takeaways
- According to the Verizon report published on 19 May 2026, exploiting vulnerabilities has become the leading way into data breaches: 31% of cases, against 13% for stolen credentials.
- In small and mid-sized businesses hit by ransomware, Verizon points to compromised credentials (38%) or unpatched vulnerabilities in network edge devices (29%), the family that VPNs and firewalls belong to.
- In 2026, VPN vulnerabilities from SonicWall and Palo Alto Networks were exploited before or shortly after fixes were released; the second one was used to deploy Qilin ransomware.
- Only 26% of vulnerabilities known to be exploited were fully remediated by organisations in 2025, with a median delay of 43 days.
- What protects you: expose less, patch fast, require strong authentication and read the connection logs.
What is happening
On 14 July 2026, SonicWall published advisory SNWLID-2026-0008. It covers two flaws in its SMA 1000 remote-access appliances: the first, rated critical, lets an unauthenticated attacker make the device send requests it should not send; the second makes it possible to run commands on the system. The same day, CISA added both to its catalogue of actively exploited vulnerabilities, with a 17 July deadline for US federal agencies, and also required them to look for signs of compromise. The catalogue now flags their use in ransomware campaigns.
Rapid7's detection team spotted the attacks, even before the advisory came out. Its 15 July write-up describes what happened next: the attackers took credentials, the database of active sessions and the secrets that generate users' two-factor authentication codes, enough to keep lasting access even after a clean-up. They then authenticated directly against the company directory, from the appliance itself. In Rapid7's view, the box meant to filter access had become an unmonitored back door into the heart of the network.
Two months earlier, on 13 May 2026, Palo Alto Networks published an advisory on a flaw in its GlobalProtect VPN: an authentication bypass allowing an unauthorised VPN connection, under certain configurations. CISA added it to its catalogue on 29 May. On 20 July, Arctic Wolf researchers described several intrusions in June 2026 that all started with this flaw on the firewall and ended with data encrypted by Qilin ransomware. In between: credential theft, moving from machine to machine, data exfiltration and, in some cases, attacks on the backup servers.
These cases illustrate a measured trend. Verizon's 2026 Data Breach Investigations Report, published on 19 May 2026, finds that exploiting vulnerabilities has become the leading way into data breaches, at 31% of cases, for the first time in nineteen years of reports. Among the access to company networks offered for sale by specialised brokers, 44% was VPN access. And patching is slowing down: only 26% of the vulnerabilities in CISA's catalogue were fully remediated in 2025, against 38% a year earlier, with the median delay rising from 32 to 43 days.
What VPN vulnerabilities mean for your business
A VPN has an awkward feature: it must be reachable from the Internet, by design, since that is its job. So it is visible to everyone, all the time, and anyone scanning for vulnerable devices finds it effortlessly. Once breached, it gives the attacker the same trust as an employee connecting from home.
Being a small business is no protection. Verizon notes that these attacks are mostly opportunistic: attackers look for vulnerable devices, not for a particular company. Among ransomware victims whose size was known, about 96% were small and mid-sized businesses.
In many small businesses, the VPN appliance was installed years ago by a provider, and nobody really knows who should apply its updates, or who receives the vendor's security alerts. That gap is exactly what attackers exploit: the flaw is published, the fix exists, but the device is not updated.
Finally, when a flaw was exploited before being patched, installing the fix is no longer enough. The SonicWall case shows it: an attacker who copied passwords and two-factor secrets can walk back in through the front door. Those secrets must then be renewed and the logs checked. And if the attack goes as far as ransomware, the quality of your backups decides what comes next, a topic I covered in the article on backups against ransomware.
What I learned from it
In late August 2026, an automated scan of my server, looking for pages known to be vulnerable, triggered an alert. It had no impact, but it pushed me back to a simple question: what of mine is visible from the Internet, and why? In September 2026, I placed the administration of my management system, the one that runs the accounting, websites and appointments of my companies, behind a modern VPN that I run myself. What stays public is limited to what my visitors and clients need: the websites and the customer area. Server administration goes the same way, with keys rather than passwords. It is the same principle as for the administration portal of my servers, reachable only through the VPN.
This hardening taught me three things, which all have one thing in common: they produce no error message.
First, you can close too much. The login page my clients use to reach their area has to stay public: mistaking it for administration would have cut off a real service. You need to separate what clients do from what the administrator does, and close only the latter.
Second, a protection depends on what it sees. Automatically blocking addresses that keep trying relies on the connection logs. If those logs stop being written, the protection goes blind without reporting anything. So you need to check, from time to time, that it still sees something go by.
Third, a change reported as applied is not necessarily applied. A configuration change can be accepted without error and never take effect. After each change, check the result from the outside, as an attacker would see it, rather than trusting the confirmation message.
The VPN then becomes the most important gateway in the setup. It has to be kept up to date, accept keys only, log its connections, and be changed with care: a mistake on that gateway can lock the administrator out of their own servers.
What to do in practice
1. Take stock of what is exposed
List everything reachable from the Internet: VPN, firewall, remote desktop access, administration interfaces of your software. For each device, note the model, the version and, above all, the name of the person responsible for its updates.
2. Take off the Internet what does not need to be there
An administration interface does not need to be public: put it behind the VPN. Never expose remote desktop access directly. What cannot be seen cannot be hit by an automated scan.
3. Patch in days, not weeks
Subscribe to your VPN vendor's security alerts and check CISA's catalogue of exploited vulnerabilities. When a flaw in your equipment appears there, patching becomes urgent. Plan to replace devices that no longer receive updates.
4. Require strong authentication
A password alone is not enough to get into your network. Turn on two-factor authentication for the VPN, ideally with a phishing-resistant method (hardware key, certificate), and remove unused accounts.
5. Log and look
Keep the VPN connection logs somewhere other than the device, so an attacker cannot erase them. Get alerted on unusual connections: in the middle of the night, from another country, from an unknown machine. Check now and then that the logs are still being written.
6. Prepare for the day a flaw is exploited
If your equipment appears in an active exploitation alert, apply the fix, then renew passwords and two-factor secrets, and review the logs. And make sure your backups are out of reach of an attacker who has got through the VPN.
Frequently asked questions
Is our VPN a risk if we are a small business?
Yes, as much as anywhere else. Attackers sweep the Internet for vulnerable devices without looking at the size of the company behind them. An up-to-date VPN, protected by two-factor authentication and monitored, remains a good way to work remotely, though.
Should we replace our VPN appliance?
Not necessarily. A device still supported by its vendor, updated quickly and protected by strong authentication can stay in place. Replacement becomes necessary when the device is no longer maintained, or when nobody is able to keep it up to date.
Is a VPN enough to protect access to our software?
No. It reduces what is exposed, but once connected, a user or an attacker reaches whatever the network allows. You also need to limit what each account can reach, protect administrator accounts and keep offline backups.
Going further
I design and run infrastructure for small and mid-sized businesses, remote access included: see the Systems and infrastructure page. If you want to know what your company exposes to the Internet and how to reduce it, let's talk during a 20-minute call.
Sources
- Security advisory SNWLID-2026-0008 (SMA1000), SonicWall PSIRT, 14 July 2026.
- Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410), Rapid7, 15 July 2026.
- Known Exploited Vulnerabilities Catalog, CISA, entries CVE-2026-0257 (29 May 2026), CVE-2026-15409 and CVE-2026-15410 (14 July 2026).
- CVE-2026-0257 PAN-OS: Authentication Bypass in GlobalProtect, Palo Alto Networks, 13 May 2026.
- Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware, Arctic Wolf Labs, 20 July 2026.
- 2026 Data Breach Investigations Report, Verizon, 19 May 2026.
- Guidance on Edge Devices, CISA with the Australian, Canadian and British (NCSC) agencies, 4 February 2025.
Photo: Manuel Luikenga / Unsplash (unsplash.com/photos/y4GHs9GEFdM).
Tags: VPN, remote access, cybersecurity, SMB, ransomware, updates, infrastructure