VPN Vulnerabilities by Vendor: 1 in 15 Lands on CISA’s Exploited List, 14 Times the Average CVE

VPN vulnerabilities in enterprise gateways land on CISA’s list of exploited flaws at 14 times the rate of the average CVE. We matched every CVE in the National Vulnerability Database to 14 vendors’ VPN gateway products: 1,691 were published from 2020 to September 2026, 0.67% of all CVEs, yet they make up 9.2% of CISA’s Known Exploited Vulnerabilities (KEV) entries for the same years.

What counts as a VPN product here. Server-side remote-access gateways: dedicated SSL-VPN appliances (Ivanti Connect Secure, SonicWall SMA and SRA, Array AG) and the firewall or application-delivery software that terminates remote-access VPN sessions in the same image (FortiOS, PAN-OS, Cisco ASA and FTD, NetScaler Gateway, and others). Client apps, management consoles, SD-WAN, and consumer or small-business routers are excluded. Because these are multi-function edge devices, a CVE counts if it affects the gateway software at all, whether or not the flaw sits in the VPN feature. The exact CPE list is in the methodology.

Are VPN appliances overrepresented in KEV?

Yes, every year. In each publication year since 2020, VPN gateway products account for between 0.4% and 1.5% of new CVEs, but between 4.7% and 13.7% of the KEV entries for CVEs published in that year. Pooled over 2020 to September 2026, 110 of 1,691 VPN gateway CVEs (6.5%) are in KEV, against 1,191 of 253,272 CVEs of every kind (0.47%).

Percent of CVEs published in each year that affect an in-scope VPN gateway product, and percent of KEV entries (by CVE publication year) that do. *2026 is January to September. Recent years are still filling in as CISA lists older CVEs, and NVD’s 2026 total is inflated by record CVE volume, which our CVE statistics report tracks.

The gap is also visible in ransomware. KEV flags 361 entries as known to be used in ransomware campaigns; 55 of them (15%) are VPN gateway flaws, twice their 7.4% share of the catalog. Across the whole catalog, which we break down in our analysis of CISA’s Known Exploited Vulnerabilities list, edge devices stand out in the same way.

The vendor scorecard

One card per vendor, in the order of the vendor list in the methodology, not a ranking. KEV entries are all-time; CVE counts and the KEV share use CVEs published from January 2020 to September 2026. A high count can reflect a large installed base, more security research, or more transparent disclosure, so these numbers describe disclosure and exploitation, not which product is most secure.

Bars: KEV entries added per year (2021 to 2026*, 2026 through Oct 14, 2026). CVSS mix: Critical, High, Medium, Low, using NVD’s CVSS v3.x score where NIST scored the CVE and the vendor’s score otherwise. Median days are for CVEs published after KEV launched on November 3, 2021.

Which vendors have the most KEV entries per year?

No vendor leads for long. The vendor with the most VPN gateway KEV additions changed every year: Ivanti in 2021 (8), Fortinet in 2022 (5), Zyxel and Juniper in 2023 (3), Cisco in 2024 (5), SonicWall in 2025 (5), Citrix in 2026 (6). Over the whole catalog, Fortinet (20), Citrix NetScaler (18), SonicWall (16) have the most entries. The 2021 column includes the catalog’s launch on November 3, 2021, when CISA listed 24 older VPN gateway CVEs at once.

KEV entries for in-scope VPN gateway products by the year CISA added them. Red outline: the vendor or vendors with the most additions that year. *2026 through Oct 14, 2026. OpenVPN Access Server has no KEV entries.

VPN exploitation waves, 2020 to 2026

Each blue bar is a month’s KEV additions for VPN gateway products; red markers are CISA emergency directives, advisories, and notable listings. The CISA emergency directives on this timeline cover three of the scorecard’s vendors: Ivanti (twice, the first time as Pulse Secure), Cisco, and F5.

1. Jan 10, 2020Pulse Secure CISA alert AA20-010A warns of continued exploitation of Pulse Secure VPN flaw CVE-2019-11510 and notes media reports of criminals installing REvil (Sodinokibi) ransomware through unpatched Pulse Secure VPN servers. ^[1]
2. Jan 20, 2020Citrix Alert AA20-020A covers CVE-2019-19781 in Citrix ADC, Gateway, and SD-WAN WANOP. Citrix shipped fixes for the affected versions between January 19 and 24, 2020. ^[2]
3. Mar 13, 2020All vendors Alert AA20-073A, Enterprise VPN Security: as organizations moved to telework, CISA warned that more VPN vulnerabilities were being found and targeted. ^[3]
4. Apr 20, 2021Pulse Secure Emergency Directive 21-03 orders federal agencies to enumerate Pulse Connect Secure appliances by 5 pm EDT on April 23, 2021, after exploitation of CVE-2021-22893. Alert AA21-110A is published the same day. ^[4]
5. Jul 20, 2023Citrix Advisory AA23-201A: CVE-2023-3519 was exploited as a zero-day in June 2023 to drop a webshell on a critical infrastructure organization’s NetScaler ADC. ^[5]
6. Nov 21, 2023Citrix Advisory AA23-325A: LockBit 3.0 affiliates exploit Citrix Bleed (CVE-2023-4966), with exploitation identified as early as August 2023. ^[6]
7. Jan 19, 2024Ivanti Emergency Directive 24-01 covers CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Policy Secure. Supplemental Direction V1 (January 31) orders agencies to disconnect every instance by 11:59 PM on February 2, 2024. ^[7]
8. Feb 29, 2024Ivanti Advisory AA24-060B: attackers deceived Ivanti’s Integrity Checker Tool, which failed to detect compromise. ^[8]
9. Apr 12, 2024Palo Alto Networks CISA adds CVE-2024-3400, command injection in the PAN-OS GlobalProtect feature, to KEV. ^[KEV]
10. Sep 25, 2025Cisco Emergency Directive 25-03 covers CVE-2025-20333 and CVE-2025-20362 in the ASA and FTD VPN web server. The April 23, 2026 revision (V1) states that applying Cisco’s updates does not necessarily remove an attacker who is already on the device. ^[9]
11. Oct 15, 2025F5 Emergency Directive 26-01: a nation-state affiliated actor exfiltrated part of F5’s BIG-IP source code and vulnerability information. Agencies had to apply updates by October 22, 2025. ^[10]
12. Feb 5, 2026All vendors Binding Operational Directive 26-02 requires agencies to identify and replace end-of-support edge devices, citing widespread exploitation campaigns against them. ^[11]
13. Jun 8, 2026Check Point CISA adds CVE-2026-50751, an IKEv1 authentication bypass that can establish a remote access VPN connection, to KEV with known ransomware use. ^[KEV]
14. Mar 30, 2026 to Oct 4, 2026Citrix 6 NetScaler ADC and Gateway CVEs are added to KEV in 2026, the most for any vendor this year. ^[KEV]

Bracketed numbers refer to the references below. [KEV] items come from the CISA KEV catalog’s dateAdded field.

How fast VPN flaws reach KEV

For VPN gateway CVEs published after KEV began, the median gap between NVD publication and the KEV listing is 1.5 days, against 7.5 days for every CVE in the catalog published in the same period. 57 of 84 (68%) were listed within a week of publication, against 50% catalog-wide. Many are listed the day the CVE is published, the pattern of zero-day exploitation: Fortinet, Ivanti, Cisco, and Citrix all have a median of zero days. Zyxel (12 days), WatchGuard (33.5), Juniper (88), and Array Networks (312) are slower, on small samples.

What the exploited flaws hit

Because these devices run firewalls, load balancers, and VPNs in one image, not every exploited “VPN” flaw is in the VPN code. Reading CISA’s own description of each of the 130 entries, 52 name the VPN or remote-access service (SSL-VPN portals, GlobalProtect, the ASA and FTD VPN web server, IKE, or gateway mode on NetScaler), 39 name the management or administrative interface, and 39 name neither. Exploited flaws skew severe: 72 of the 130 (55%) are rated Critical, against 10% of all VPN gateway CVEs since 2020. But 58 are rated High or Medium, so a patch policy that only fast-tracks Critical scores would have missed them.

Sorted by all-time KEV entries. “Ransomware-linked” is KEV’s knownRansomwareCampaignUse = Known. Component columns classify CISA’s KEV name and short description by keyword; see methodology.

What this means for MSPs

Treat the gateway as the highest-risk asset on each client network. With 1 in 15 VPN gateway CVEs ending up in KEV and a median listing gap of 1.5 days, a monthly patch cycle is too slow for these devices. Keep an inventory of every client’s remote-access gateway (vendor, model, version, support status) and an out-of-band process that can patch it within days of a KEV listing. Subscribing to the KEV feed and filtering it on the CPE list below covers every product in this scorecard.

Close the management plane. 39 of the 130 exploited entries name the management interface. Keep administrative web and API interfaces off the internet and reachable only from a management network.

Patch, then hunt. CISA’s ED 25-03 revision says Cisco’s updates do not necessarily remove an attacker already on the device, and advisory AA24-060B found Ivanti’s integrity checker could be deceived. After an emergency patch on an exposed gateway, check for compromise and rotate credentials and session secrets the device holds.

Do not count on MFA alone. CVE-2020-12812 let FortiOS SSL VPN users skip the FortiToken second factor, and several entries are unauthenticated remote code execution, where no login is involved. Ransomware groups are heavy users of these flaws, which fits the pattern in our coding of ransomware initial access vectors from CISA advisories.

Retire end-of-support hardware. BOD 26-02 now requires federal agencies to replace unsupported edge devices. The same logic applies to client SSL-VPN appliances that no longer get fixes.

Frequently asked questions

What are the security vulnerabilities of VPNs?

For organizations, the exploited flaws sit in the VPN gateway itself. Of the 130 VPN gateway entries in CISA’s Known Exploited Vulnerabilities catalog, CISA’s description names the VPN or remote-access service in 52, the management interface in 39, and neither in 39. 72 of the 130 carry a Critical CVSS score.

Is there any danger in using a VPN?

For enterprise VPN gateways, the risk is measurable: 6.5% of the 1,691 VPN gateway CVEs published from 2020 to September 2026 are in KEV, against 0.47% of all CVEs. 55 of the 130 exploited VPN gateway flaws (42%) are flagged for known ransomware use. This analysis covers gateway appliances, not consumer VPN apps.

Which VPN vendor has the most vulnerabilities?

By KEV entries, Fortinet (20), Citrix NetScaler (18), SonicWall (16) lead. By published CVEs since 2020, F5 (363, because NVD maps most BIG-IP CVEs to the APM module) and Cisco (292) lead. These counts reflect disclosure and exploitation, and installed base, not how secure a product is.

What was the Ivanti VPN vulnerability?

In January 2024, CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure led CISA to issue Emergency Directive 24-01 on January 19, 2024, then order federal agencies to disconnect every Ivanti Connect Secure and Policy Secure instance by February 2. Ivanti and Pulse Secure products account for 15 KEV entries in total.

How fast are VPN vulnerabilities exploited?

For VPN gateway CVEs published since KEV launched in November 2021, the median gap between NVD publication and the KEV listing is 1.5 days (84 CVEs), against 7.5 days for the whole catalog. 57 of the 84 were listed within a week.

Methodology

References

1. CISA, AA20-010A: Continued Exploitation of Pulse Secure VPN Vulnerability. Accessed October 2026.
2. CISA, AA20-020A: Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP. Accessed October 2026.
3. CISA, AA20-073A: Enterprise VPN Security. Accessed October 2026.
4. CISA, ED 21-03: Mitigate Pulse Connect Secure Product Vulnerabilities and AA21-110A. Accessed October 2026.
5. CISA, AA23-201A: Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells. Accessed October 2026.
6. CISA, AA23-325A: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability. Accessed October 2026.
7. CISA, ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities and Supplemental Direction V1. Accessed October 2026.
8. CISA, AA24-060B: Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways. Accessed October 2026.
9. CISA, ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices (V1). Accessed October 2026.
10. CISA, ED 26-01: Mitigate Vulnerabilities in F5 Devices. Accessed October 2026.
11. CISA, BOD 26-02: Mitigating Risk From End-of-Support Edge Devices. Accessed October 2026.
12. CISA, Known Exploited Vulnerabilities Catalog (JSON feed; CC0 licence). Accessed October 2026.
13. NIST, National Vulnerability Database CVE API 2.0. Accessed October 2026.