Security incidents tagged VPN. Newest first.
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Cisco patched CVE-2026-76418 (CVSS 8.6), a denial-of-service bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not needed. Cisco PSIRT became aware of active exploitation in October 2026 and strongly recommends upgrading. Devices are affected when webvpn is enabled on an interface and a tunnel group (including DefaultWEBVPNGroup) uses secondary-authentication-server-group. There is no workaround, but disabling secondary authentication mitigates it. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN devices.
Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD)Since Oct 28, 2026
On October 27 WatchGuard published 18 advisories: 17 for Fireware OS, the operating system on Firebox firewalls, and one for the Mobile VPN with SSL client for Windows. The worst are a pre-authentication stack buffer overflow in the SIP proxy that lets a remote, unauthenticated attacker run code by sending a crafted request through a policy that uses the SIP proxy (CVE-2026-93857, CVSS 9.2), a pre-authentication integer overflow in Access Portal WebSocket handling that lets an unauthenticated attacker write past a heap buffer when Access Portal is enabled (CVE-2026-93866, 9.2), and a missing-authentication bug in the FireCluster sync daemon that lets an unauthenticated attacker trigger privileged system actions through the FireCluster management IP when clustering is enabled (CVE-2026-93865, 9.2). Other critical bugs need a network position: heap overflows in the Active Directory authentication service reachable by whoever controls or intercepts traffic to the configured AD server (CVE-2026-112709, CVE-2026-112710, 9.2), a stack overflow in the logging service via a crafted certificate from an impersonated log server that gives root (CVE-2026-103593, 9.1), and a stack overflow in WireGuard configuration processing reachable by a man-in-the-middle between the Firebox and WatchGuard Cloud (CVE-2026-103594, 9.5). The rest cover FireCluster privilege escalation and denial of service, an XPath injection in SSH authentication that leaks configuration secrets, an AuthPoint MFA session-hijack bug, root file modification and overwrite, and denial of service in the management interface and certd. WatchGuard says it is not aware of exploitation in the wild for the bugs it lists. Update to Fireware OS 2026.4 or 12.12.4 (12.5.22 on T15 and T35), and Mobile VPN with SSL client to 2026.4.
WatchGuard Fireware OS (Firebox firewalls) and Mobile VPN with SSL client for WindowsSince Oct 27, 2026
Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale confirmed the SSH issues as serious privilege-escalation bugs and on Oct 28 released Tailscale 1.104.4 with bulletins TS-2026-014 (SSH unix-socket forwarding to root-only sockets such as the Docker socket or local API), TS-2026-015 (SSH session memory exhaustion), TS-2026-016 (serve unix backends reaching privileged sockets) and TS-2026-017 (HTTP/2 serve capability mix-up). Upgrade to 1.104.4 or newer; the bulletins do not cover the app-connector or headscale findings. It is lateral movement from a foothold, not internet RCE.
Tailscale client (tailscaled, Tailscale SSH, serve, app connectors) and headscaleSince Oct 25, 2026
CVE-2026-102255 (CVSS 10.0) is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface: an unintended alternate access path lets a remote attacker make the appliance send requests to internal functionality and perform unauthorized operations. It affects SMA1000 6210, 7210 and 8200v models (not SMA 100 or firewall SSL-VPN). SonicWall disclosed it on Oct 6; exploitation attempts began Oct 8, and Horizon3.ai warns it can lead to device takeover. Update to 12.4.3-03670 or 12.5.0-03082.
SonicWall SMA1000 (6210, 7210, 8200v)Since Oct 6, 2026
Citrix's CTX697096 bulletin fixes eight NetScaler ADC and Gateway bugs, two of them critical unauthenticated remote code execution zero-days exploited in the wild: CVE-2026-88771 (improper input validation, affects every deployment, no preconditions) and CVE-2026-88772 (memory overflow on appliances with DTLS enabled, which is the default on VPN virtual servers). Both score CVSS 4.0 9.5 and were added to CISA KEV on Sep 27. Attackers chain CVE-2026-88771 with the SAML crash CVE-2026-88779 to get root, plant PHP web shells and steal configs and keys, and exploitation was still being reported in late October. A follow-up SAML bug, CVE-2026-107406, needs newer builds (14.1-73.46 / 13.1-64.29). Patch, then run a compromise assessment: patching does not remove persistence.
Citrix NetScaler ADC and NetScaler GatewaySince Sep 27, 2026
Ivanti Connect Secure, Policy Secure, ZTA Gateways
An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.
Check Point Quantum Security Gateways
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.
Palo Alto Networks PAN-OS
A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.
Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons
Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.
🚨 Cisco patches actively exploited ASA and FTD firewall flaw. CVE-2026-76418 (CVSS 8.6) can let unauthenticated attackers remotely crash affected firewalls, causing denial of service. No successful VPN login required. Details + affected versions ↓ t.co/c0xxNRltVP
‼️ UPDATE - Tailscale confirms the Tailworm SSH flaws are real. Its new investigation page says most of what it found is privilege escalation and calls the issues “serious.” Fix targeted within 24 hours — no CVE or patched version out yet. Mitigate now: → Set t.co/hGOawLtQlH
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws. In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node. t.co/pK4NPIOd9g