Your Security Appliances Are the Attack Surface

The report warns that firewalls, VPN gateways, and other security/network appliances have become a primary attack surface: analysis of zero-day trends, CISA KEV entries, NVD CWE data, and EPSS scores shows frequent, active exploitation (including 21 appliance zero-days in 2025 and rising KEV share into 2026), widespread use by ransomware campaigns, and sustained targeting by China-aligned actors; it urges treating appliances as potentially compromised endpoints, improving detection around them, accelerating patching, and moving toward architectures that avoid concentrating trust in single perimeter devices.