The Lurking Threat of Edge Security Products

The Censys Research Team warns that routine disclosure and active exploitation of critical vulnerabilities in edge security products (firewalls, VPNs, and related appliances) have become a preferred initial-access vector for threat actors, with multiple CVEs added to CISA’s Known Exploited Vulnerabilities catalog and observed campaigns (including activity attributed to Chinese state-backed actors). The report highlights widespread exposure (e.g., thousands of potentially vulnerable Ivanti devices), examples of authentication bypass and RCE flaws (Palo Alto, SonicWall, Ivanti), and recommends prompt patching, mitigation (restricting management interfaces), and continuous external attack-surface monitoring.