Look at the remote-access advisories stacked up this year and a pattern jumps out that no single vendor's PR team can explain away.

SonicWall SMA1000 — CVE-2026-15409 and CVE-2026-15410, under active exploitation and listed in CISA's Known Exploited Vulnerabilities catalog. Chained together, an unauthenticated server-side request forgery gives an attacker an initial foothold, then administrator-level code execution lets them take over the appliance outright.

Ivanti Sentry — CVE-2026-10520, a CVSS 10.0 pre-authentication OS command injection yielding root through the management port. Compromises were observed shortly after the patch was released.

Fortinet FortiOS — CVE-2026-0847, a CVSS 9.8 authentication bypass in the SSL-VPN function, serious enough that CISA issued a Binding Operational Directive telling agencies to patch or disable affected SSL-VPN services within 72 hours.

Citrix NetScaler ADC/Gateway — CVE-2026-3055, in the KEV catalog, affecting appliances configured as a SAML identity provider.

Four different vendors. Four different codebases. Same year, same category, same outcome.

This isn't a vendor problem

It's tempting to read that list as "Ivanti has a quality problem" or "SonicWall needs better code review." That framing is comfortable and wrong, and it leads people to the useless conclusion that they just need to pick a better appliance.

The real issue is structural. Any device whose job requires it to listen on the public internet is, by definition, a permanent and discoverable target. It has to answer unsolicited packets from strangers to function. That means it can be found by scanners, fingerprinted for version, and tested against every exploit as soon as one exists — continuously, by everyone, forever.

The appliance isn't the thing protecting your perimeter anymore. The appliance is the perimeter, and it's the first thing attacked.

Patching is necessary and insufficient

Consider what the defense actually requires of you. A 72-hour federal directive means the government considers three days an aggressive-but-acceptable window. Meanwhile, exploitation has been observed shortly after patch release — because publishing a patch tells attackers exactly what to reverse-engineer, and there are always thousands of unpatched devices.

So the honest description of the patching treadmill is: you are in a race where the starting gun is fired by your own vendor's advisory, the attackers are already sprinting, and you have to win every single time, on every appliance, forever. Losing once is enough.

Patch anyway — please. But understand you are managing the odds, not eliminating the exposure.

The governments have noticed

This is no longer a vendor-marketing argument. In January 2026 the NSA published its first Zero Trust Implementation Guidelines, moving Zero Trust from theory into concrete practice: assume breach, verify continuously, enforce granular identity-driven access.

Shortly after, CISA directed federal agencies to inventory and remove end-of-support edge devices — explicitly including aging VPN gateways — calling them one of the most persistent intrusion paths into government networks.

That's the regulator's version of what practitioners have been saying for a while: the exposed remote-access box is a structural liability, and the fix isn't a better box.

Remove the target instead

The alternative isn't a hardened appliance. It's not having an appliance the internet can see.

That's what Single Packet Authorization does. Our gateways stay completely dark — they do not respond to any traffic until they receive a single cryptographically valid packet from a client that's been seeded with the right secret. To a scanner, there is no service. No open port, no banner, no version string, no product to look up in a CVE database.

Follow that through to the advisories above. Every one of those attack chains begins with reaching the appliance: sending an SSRF request to it, injecting a command into its management port, bypassing its authentication. If unauthorized traffic never gets a response, the first step of every one of those chains fails — regardless of whether the underlying bug exists or is patched. You stop being a discoverable target rather than being a well-defended one.

And because access is granted per-application rather than at the network level, an attacker who does obtain a valid credential still isn't handed a network to move through.

Where the market is going

This isn't a fringe position anymore. Reporting for 2026 indicates over 70% of new remote-access deployments now choose ZTNA over VPN, and roughly 65% of enterprises plan to replace traditional VPNs outright. The ZTNA market is projected to grow from about $1.34B in 2025 to $4.18B by 2030.

One honest caveat: VPN coexistence is real. Organizations with legacy client-server applications will run both for a while, and anyone telling you to rip out remote access over a weekend is selling something. The workable path is to deploy ZTNA alongside the VPN, migrate application by application — replicating your existing access rules as entitlements — and decommission the concentrator once the last app is moved.

But start. Every month the appliance stays exposed is another month of being in a race you have to win every time.

Curious how exposed you are today? Take the 2-minute Zero Trust readiness quiz, or read how cloaking holds up against AI-driven attacks.

Sources: CISA Known Exploited Vulnerabilities catalog and advisories; NSA Zero Trust Implementation Guidelines (Jan 2026); industry reporting on 2026 edge-device exploitation and ZTNA adoption.