The Edge Device Is the Perimeter: Why the Box You Bought to Keep Them Out Is How They Get In

By John

Synacor disclosed the Zimbra flaw on 26 June and shipped a fix on 20 July. On 20 August, the Shadowserver Foundation counted 155 compromised internet-facing Zimbra servers. Two days later it counted 274. The patch had been available for thirty-three days, and roughly 8,200 systems still had not applied it.

Nothing about that sequence is unusual, which is the point. The mail gateway, the VPN concentrator, the firewall — the boxes that sit at the boundary and decide who gets in — have quietly become the most reliable way into a corporate network. Not despite being security products. Because of what being one requires.

The number that changed

Mandiant’s M-Trends 2026 report puts exploitation of internet-facing systems at 32% of intrusions where investigators could identify an entry point. That has been the leading vector for six consecutive years, and on its own it is old news.

The interesting figure is underneath it. Edge devices and VPNs went from 3% to 22% of exploitation-driven breaches in a single year. A seven-fold shift in twelve months is not a trend line; it is a target migration. Attackers moved, and they moved because everyone else did too — endpoints went to EDR, workloads went to cloud-native monitoring, and the appliances at the boundary stayed exactly where they were, running vendor firmware nobody outside the vendor has ever read.

Two more numbers from the same report explain the urgency. Median dwell time rose to 14 days, up from 11. And the gap between initial access and handoff to a second threat group collapsed from more than eight hours in 2022 to 22 seconds. Initial-access brokers now stage the follow-on tooling during the first intrusion. By the time an alert renders, the network has changed hands.

The softest hard target

Ask why this class of device is so productive for attackers and the honest answer is a list of design constraints, not a list of mistakes.

An appliance is built to be sealed. Mandiant’s investigators put the consequence plainly: these devices are “designed with minimal onboard storage and cannot support traditional security tooling,” so file system or memory forensics “presents a significant challenge, often leaving security teams with limited artifacts to confirm an attacker’s presence or properly scope the remediation.” A compromised laptop leaves a forensic trail. A compromised VPN concentrator often leaves an assertion.

It gets worse in combination with retention policy. Espionage cases in the report ran to a median 122 days of dwell time, and the BRICKSTORM backdoor sat in networks for close to 400. Standard log retention is 90 days. Mandiant’s phrasing is that organisations are left “completely blind to the initial access vector” — the evidence expired before anyone went looking for it.

Then there is the detail that should reframe how anyone thinks about these boxes: attackers use the appliance’s own native packet-capture functionality to harvest plaintext credentials in transit. No lateral movement, no malware on an endpoint, no privilege escalation. The device was built to see all the traffic. Whoever owns it inherits that.

Which brings up the structural problem nobody has solved. Everything in a modern security architecture treats the boundary device as the thing enforcing trust. It is, itself, the least monitored asset in the building.

The patch window is the attack window

The Zimbra case is worth sitting with, because the reflex reading — negligent admins — is wrong.

CVE-2026-73570 is a command injection in the SNMP monitoring component. An unauthenticated attacker sends a crafted SMTP request that reaches the SNMP processing path, and arbitrary operating system commands run as the zimbra service account. CISA added it to the Known Exploited Vulnerabilities catalog and gave federal agencies until 24 August. The compromise count rose 77% in the 48 hours before that deadline, driven by automated tooling.

Now consider what applying that patch means operationally. Zimbra is the company’s mail. Patching it is a scheduled outage that needs a change ticket, a maintenance window, a rollback plan and someone available at 2 a.m. The exploit needs none of those things. One side of that race is governed by change control and the other by a script, and the asymmetry is not a failure of diligence — it is arithmetic. We have watched this same gap play out on SharePoint, where a May patch became a three-day federal emergency in July.

Cisco’s August advisory sharpens the irony. CVE-2026-20349, CVSS 8.6, affects the Remote Access SSL VPN service on ASA and FTD. Insufficient error checking on crafted HTTP requests lets an unauthenticated remote attacker force the firewall to reload. No credentials. No administrator interaction. Cisco confirmed active exploitation and CISA set a 14 August remediation deadline, with hot fixes spanning ASA 9.16 through 9.24 and FTD 7.0 through 10.0.

Read the outcome of the attack and the outcome of the fix side by side: the exploit reboots your firewall, and so does the patch. When the remedy and the attack produce the same disruption, the incentive to move quickly gets weaker, not stronger. That is the kind of second-order effect that keeps a vulnerability class alive for years. It is also why patch governance belongs in a compliance audit rather than a backlog — the window is a policy decision, and somebody should be signing it.

Five years, one product line

None of this is new, and the continuity is the strongest evidence that the cause is structural.

Pulse Connect Secure was exploited from June 2020 or earlier, and by April 2021 suspected China-nexus actors had used it against government agencies, defence contractors and financial institutions across the US and Europe. The product was renamed Ivanti Connect Secure. In December 2023, Volexity traced webshells on multiple servers back to an internet-facing Ivanti appliance, producing CVE-2023-46805 and CVE-2024-21887, attributed to UNC5221. In January 2025, two more — CVE-2025-0282 and CVE-2025-0283 — with zero-day exploitation running from mid-December 2024.

Same product lineage, same actor profile, five years apart. Cisco, Citrix, Fortinet and Zimbra each have their own version of that timeline.

And when persistence enters the picture, the appliance model breaks down entirely. The ArcaneDoor actor built a mechanism inside FXOS, the base operating system underneath Cisco’s firewall software, that survived upgrading to a fixed release. The standard remediation for a compromised appliance is to patch it. Here, patching it changed nothing.

Mandiant also reports a mean time to exploit of negative seven days — exploitation, on average, beginning before the patch exists. Any defensive posture whose first move is “apply the update” is starting a week behind.

What actually helps

The uncomfortable conclusion is that the usual playbook is unavailable here. You cannot install an agent on the box. You often cannot image it. You will not always get a patch before the attack. So the useful moves are the ones that assume all of that.

Treat the appliance as untrusted infrastructure rather than as a control. If a VPN concentrator terminating your remote workforce is compromised, what does the attacker reach next? If the answer is a flat internal network, the appliance is not a boundary — it is a single point of total failure with an SSL certificate on it. The credential-harvesting behaviour makes this concrete: assume everything that passed through the device is already in someone else’s hands, and plan the identity response accordingly.

Extend retention past 90 days for edge telemetry specifically. It is the cheapest fix on this list and directly addresses the blindness Mandiant describes. Six months of syslog from four appliances costs very little; the alternative is discovering a 122-day intrusion with 90 days of evidence.

Reduce what is reachable. The Zimbra flaw required the optional zimbra-snmp package and a non-default configuration — which means a meaningful share of the 8,200 exposed systems were carrying an attack surface they never deliberately turned on. Management interfaces, optional daemons and legacy protocols on an internet-facing box are all inventory nobody audits until it appears in a CVE.

Build a lane for KEV-listed edge devices that bypasses the normal change calendar, with the outage pre-authorised. If the process requires a week to patch a box that gets exploited in hours, the process is the vulnerability. And keep availability in the threat model: a flaw whose only effect is forcing a reload is a denial-of-service primitive handed to anyone with an HTTP client.

Finally, make telemetry a procurement requirement. Ask a vendor what forensic artifacts their appliance produces after a compromise, and what you are supposed to do with a device you cannot image. The answers are currently poor across the industry, and they will stay poor for exactly as long as nobody makes them part of the purchase decision.

Over 500 critical-infrastructure organisations have now been hit by Medusa ransomware alone, up from around 300 in the previous version of that advisory — an ecosystem that buys brokered access rather than earning it. Somebody sells that access. Increasingly, they get it from the box you bought to keep them out.