[EXP] Secure Remote-Access Gateway Compromise and Identity Pivoting Risk

Report Type: EXP — Exploitation Risk Assessment
Threat Category: Secure Remote-Access Gateway Compromise and Identity Pivoting
Assessment Date: July 15, 2026
Amendment Date: October 15, 2026
Primary Impact Domain: Identity, Credential, and Remote-Access Trust
Secondary Impact Domains: Endpoint Security, Internal Infrastructure, Cloud Resources, Business Continuity, Compliance, and Incident Response
Affected Asset Class: Secure Remote-Access Gateways, VPN Appliances, Identity-Integrated Access Systems, Administrative Platforms, Endpoints, and Cloud-Connected Resources
Threat Objective Classification: Appliance Control, Authentication-Material Exposure, Valid-Account Abuse, Identity Pivoting, Internal Expansion, and Cloud-Resource Access

Published by: CyberDax LLC
Author: Edward “Tony” Dolley
Role: Founder / Principal Threat Researcher, CyberDax LLC
Publication Date: July 15, 2026
Publication Type: Cybersecurity Research Report / White Paper

S2 BLUF

Secure remote-access gateway compromise and identity pivoting create material enterprise risk because an internet-facing appliance that brokers trusted access between external users and internal systems may be converted into a platform for appliance-local service access, unauthorized administrative activity, authentication-material exposure, gateway-originated internal authentication, and downstream identity-based expansion. The technical risk arises when suspicious proxy, relay, WebSocket, tunneling, request-routing, code-execution, configuration, hotfix, service, route, filesystem, session, credential, token, TOTP, or directory-integration behavior allows an adversary to move from external interaction with the gateway into control over appliance functions or trusted internal access paths. Observed activity may represent failed probing, unconfirmed exploitation, limited appliance manipulation, or successful compromise followed by credential use, service-account abuse, endpoint execution, internal discovery, lateral movement, cloud-resource access, persistence, security-control degradation, or data exposure. Immediate executive action is required to identify exposed and high-value gateways, validate vulnerable-state and patch history, preserve gateway and identity evidence, review appliance configuration and administrative activity, correlate VPN sessions with gateway-originated authentication, assess credential and TOTP exposure, examine downstream endpoint, internal-network, and cloud activity, rotate exposed authentication material, and rebuild or redeploy affected gateways when trust cannot be restored.

Executive Risk Translation

Remote-access gateway compromise shifts the business risk from a single vulnerable appliance or exploit path to uncertainty over whether the organization can still trust the identities, sessions, credentials, administrative connections, and downstream systems that relied on the gateway. When available evidence cannot reliably distinguish failed exploitation from successful appliance compromise and identity pivoting, leadership may need to assume that gateway administrator credentials, directory-integration accounts, active sessions, authentication tokens, TOTP seed material, user access paths, service accounts, and connected internal or cloud resources were exposed until proven otherwise. That response may require emergency patch validation, gateway isolation, forensic preservation, configuration comparison, credential and token rotation, TOTP reset, identity review, VPN-session analysis, endpoint and cloud investigation, gateway replacement, legal and compliance assessment, cyber-insurance coordination, executive reporting, and formal confirmation that remote-access trust can safely be restored.

S3 — Why This Matters Now

·        Secure remote-access gateways are internet-facing trust brokers that frequently connect external users to internal applications, identity services, administrative systems, cloud resources, and business-critical infrastructure.

·        Multiple vulnerabilities and exploitation techniques can produce the same durable operational sequence: suspicious external interaction, appliance-local service access, unauthorized gateway activity, authentication-material exposure, gateway-originated authentication, downstream endpoint execution, or internal identity pivoting.

·        Public exploit information, proof-of-concept availability, KEV designation, vulnerable firmware, and continued internet exposure increase urgency, but compromise confidence must come from correlated gateway, appliance, VPN-session, authentication, directory, endpoint, network, and cloud evidence.

·        Remote-access gateways may hold or process administrator credentials, directory-integration accounts, active-session data, authentication tokens, cookies, TOTP seed material, VPN context, certificates, configuration secrets, and trusted internal-routing information.

·        Gateway compromise can allow adversaries to originate authentication and network activity from a system already trusted to communicate with domain controllers, identity services, management systems, internal applications, cloud platforms, and high-value infrastructure.

·        Patching alone is not sufficient containment when suspicious proxy activity, unauthorized configuration changes, authentication-material exposure, gateway-originated authentication, endpoint execution, or downstream expansion may have occurred before remediation.

·        The highest-risk condition occurs when suspicious external gateway interaction is followed by successful appliance-local connection behavior, unauthorized administrative activity, use of gateway-integrated accounts, authentication without an expected VPN session, or access to internal identity and management systems.

·        Closed or managed appliances may not expose process, command-line, memory, file, database, or session telemetry, making successful exploitation difficult to confirm directly.

·        Reverse proxies, NAT, load balancers, shared addresses, and incomplete session attribution can obscure the original external source, remote user, appliance node, or downstream authentication path.

·        Legitimate vendor support, gateway administration, health checks, directory synchronization, hotfix activity, backup, restoration, monitoring, vulnerability testing, and incident response can resemble portions of the compromise sequence when viewed in isolation.

·        Missing gateway destination fields, incomplete administrative logs, weak VPN-session retention, unreliable workstation names, inconsistent service-account mapping, and poor timestamp alignment can force a broader and more expensive investigation.

·        Detection focused only on CVE identifiers, firmware versions, exploit strings, source IP addresses, URI paths, WebSocket activity, hotfix identifiers, or isolated authentication anomalies cannot provide durable assurance across changing gateway exploitation methods.

S4 — Key Judgments

·        Secure remote-access gateway compromise should be treated as an enterprise trust, identity, credential, remote-access, and internal-expansion risk, not only as a vulnerability-management or patching issue.

·        The primary enterprise risk is reduced ability to determine whether suspicious external gateway interaction led to appliance-local access, unauthorized execution, configuration manipulation, authentication-material exposure, gateway-originated authentication, or downstream identity pivoting.

·        Suspicious proxy, relay, or WebSocket behavior involving loopback, link-local, localhost, appliance-local, or prohibited management destinations followed by unauthorized appliance activity or internal authentication is the strongest executive risk signal.

·        Vulnerable firmware, internet exposure, public exploit information, KEV status, or a successful protocol upgrade should not be treated as confirmed compromise without supporting gateway, administrative, session, identity, endpoint, network, or cloud evidence.

·        Business exposure increases sharply when affected gateways provide privileged remote access to domain environments, identity systems, administrative networks, production applications, cloud resources, backup infrastructure, management platforms, virtualization systems, storage environments, or regulated services.

·        Successful gateway compromise can invalidate confidence in administrator credentials, directory-integration accounts, service accounts, active sessions, authentication tokens, TOTP seeds, user access paths, and trusted source-address assumptions.

·        Authentication originating from the gateway without a corresponding authorized VPN session or approved service workflow should receive elevated scrutiny, particularly when the account, workstation, destination, protocol, or timing differs from the established baseline.

·        Incomplete appliance telemetry increases cost because the organization may need to infer compromise through gateway logs, configuration changes, authentication behavior, VPN-session records, endpoint activity, internal flows, and cloud-resource access across separate systems.

·        Rebuilding or redeploying the gateway may be necessary when appliance integrity cannot be established, authentication material may have been exposed, logs are incomplete, unauthorized changes occurred, or post-remediation activity remains unexplained.

·        The most damaging outcome occurs when gateway compromise enables service-account abuse, domain authentication, endpoint execution, lateral movement, cloud access, administrative-system compromise, persistence, data exposure, production disruption, or multi-system identity compromise.

·        Detection must remain behavior-driven so that the organization can identify comparable compromise paths across different gateway vendors, CVEs, proxy mechanisms, request encodings, WebSocket paths, administrative actions, accounts, and downstream destinations.

S5 — Executive Risk Summary

Business Risk

Secure remote-access gateway compromise can weaken the organization’s ability to trust the systems and identities used to provide remote workforce, vendor, administrator, and business-partner access to internal resources. Risk increases when affected gateways connect to domain controllers, directory services, identity providers, administrative networks, production applications, cloud platforms, backup systems, virtualization environments, storage systems, management interfaces, or regulated workloads. The business impact is not limited to the appliance; it can expand into uncertainty over whether adversaries accessed active sessions, administrator credentials, directory-integration accounts, authentication tokens, TOTP seeds, user credentials, service accounts, internal applications, endpoint systems, cloud resources, or privileged infrastructure after gaining control over a trusted remote-access path.

Technical Cause

The risk is driven by suspicious external interaction with a secure remote-access gateway combined with a proxy, relay, WebSocket, tunneling, request-routing, code-execution, administrative, configuration, hotfix, route, service, filesystem, session, or authentication weakness that enables unintended access to appliance-local or internal services. Technical exposure becomes material when external requests reference loopback, localhost, link-local, appliance-local, or prohibited management destinations and align with successful connection establishment, unauthorized appliance changes, unexpected execution, session or credential access, gateway-originated authentication, unfamiliar service-account use, endpoint activity, internal expansion, or unusual cloud-resource access. Exposure increases when the gateway does not preserve decoded destinations, appliance-local connections, process activity, administrative attribution, session identifiers, credential-store access, workstation names, original source addresses, or reliable timestamps.

Threat Posture

The threat posture is elevated because remote-access gateways are intentionally exposed to untrusted networks while maintaining trusted communication paths into internal environments. Exploitation may begin with suspicious web, proxy, relay, WebSocket, API, or administrative interaction and progress into appliance manipulation, session access, credential exposure, service-account use, internal authentication, endpoint execution, or cloud access. The posture becomes critical when the affected gateway has trusted access to domain controllers, identity systems, management platforms, backup infrastructure, virtualization systems, storage resources, administrative jump hosts, cloud control planes, regulated applications, or environments containing reusable credentials and privileged service accounts.

Executive Decision Requirement

Executives must require measurable assurance that exposed and high-value remote-access gateways are inventoried, vulnerable-state and patch history are validated, suspicious external requests are investigated, appliance configuration and hotfix activity are reviewed, gateway-originated authentication is correlated with authorized VPN sessions, directory-integration accounts are assessed, active sessions and authentication material are examined, endpoint and internal-network activity are reviewed, cloud-resource access is validated, and affected gateways are isolated, rebuilt, or redeployed when trust cannot be restored. Leadership should also require evidence that network, identity, infrastructure, cloud, endpoint, SOC, incident response, legal, compliance, cyber insurance, communications, and business owners can support rapid decisions if appliance compromise, credential exposure, identity pivoting, internal expansion, or service disruption is suspected.

S6 — Executive Cost Summary

Secure remote-access gateway compromise creates financial exposure because the organization must determine whether suspicious external interaction became appliance-level control and whether that control exposed credentials, sessions, authentication tokens, TOTP material, directory-integration accounts, internal systems, endpoints, or cloud resources. The cost profile is different from a routine firmware update because a compromised gateway may sit at a trusted boundary between the public internet and internal identity, management, production, and administrative environments. Response cost is driven by the work required to validate vulnerable-state history, preserve gateway evidence, reconstruct suspicious requests, review administrative and configuration changes, correlate VPN sessions with authentication events, assess service-account and workstation-name deviations, investigate endpoint execution, analyze internal communication, review cloud access, rotate credentials and tokens, reset TOTP material, rebuild the gateway, and prove that remote-access and identity trust have been restored.

Cost increases materially when gateway logs omit requested destinations, appliance-local connections, decoded values, session identifiers, original source addresses, administrative attribution, process activity, file access, or credential-store access. The investigation becomes more expensive when VPN-session records are incomplete, identity telemetry is stored separately, workstation names are unreliable, gateway addresses are translated or shared, clustered nodes are poorly mapped, cloud platforms preserve only a translated source address, approved service-account behavior is undocumented, maintenance records are incomplete, or telemetry retention is too short to reconstruct pre-patch activity. The highest-cost cases occur when suspected or confirmed gateway compromise affects domain authentication, privileged administrative access, cloud management, backup infrastructure, virtualization systems, storage platforms, production applications, regulated services, multiple sites, or a large remote workforce dependent on the gateway.

Low Impact Scenario

Rapid investigation confirms suspicious scanning, malformed requests, proxy or WebSocket interaction, attempted appliance-local access, or vulnerability validation without evidence of successful unauthorized gateway activity, configuration manipulation, authentication-material exposure, gateway-originated authentication, endpoint execution, internal expansion, or cloud-resource access. Activity may involve public proof-of-concept-like requests, failed proxy connections, gateway errors, service instability, or vulnerable firmware, but gateway, VPN-session, authentication, administrative, configuration, network, and identity records support a failed, contained, or non-impacting event. Response is limited to targeted patch validation, evidence preservation, focused hunting, configuration review, credential precaution, short-term monitoring, and executive assurance that gateway and identity trust were not materially affected. Estimated impact $500K - $3M.

Moderate Impact Scenario

Confirmed or strongly suspected gateway compromise affects one or more remote-access appliances where suspicious external interaction aligns with successful appliance-local connection behavior, unauthorized configuration or hotfix activity, unexplained gateway-originated authentication, unfamiliar service-account use, endpoint execution, internal discovery, or access to high-value systems. The organization cannot immediately determine whether active sessions, administrator credentials, directory-integration accounts, authentication tokens, TOTP seeds, user credentials, or downstream identity systems were exposed. Response requires enterprise-focused gateway review, configuration comparison, authentication and VPN-session reconstruction, credential and token rotation, TOTP reset, endpoint investigation, internal-network analysis, cloud review, gateway rebuild or redeployment, legal and compliance review, cyber-insurance coordination, executive reporting, and strengthened monitoring for continued identity or access activity. Estimated impact $5M - $35M.

High Impact Scenario

Secure remote-access gateway compromise becomes an enterprise-impact event when confirmed or suspected appliance control results in credential theft, active-session hijacking, TOTP-seed exposure, directory-service account abuse, domain authentication, privileged endpoint execution, lateral movement, cloud-resource access, administrative-system compromise, data exposure, persistent access, ransomware deployment, destructive activity, or widespread service disruption. The organization may need to assume that gateway administrators, remote users, directory-integration accounts, service accounts, active sessions, authentication tokens, multifactor material, internal applications, privileged systems, cloud resources, and connected business services were exposed until evidence proves otherwise. Response may require broad forensic investigation, emergency gateway isolation, credential and token rotation, enterprise TOTP reset, directory-account remediation, endpoint containment, cloud-role restriction, gateway replacement, production recovery, customer or partner notification analysis, legal and privacy escalation, cyber-insurance engagement, communications planning, executive and board reporting, and formal validation that remote-access and identity trust can safely return to operation. Estimated impact $40M - $200M+.

S6A — Key Cost Drivers

·        Number and criticality of affected secure remote-access gateways, clustered nodes, virtual appliances, sites, remote-workforce populations, administrator access paths, vendor-access paths, and business services dependent on gateway availability.

·        Scope of suspicious external interaction, including proxy, relay, WebSocket, tunneling, request-routing, API, administrative, code-execution, or appliance-local service-access behavior.

·        Availability and retention of gateway HTTP, proxy, relay, WebSocket, WAF, reverse-proxy, audit, administrative, configuration, hotfix, route, service, system, health, VPN-session, authentication, directory, firewall, NDR, endpoint, cloud, and network-flow telemetry.

·        Whether response must reconstruct external requests, destination resolution, protocol upgrades, proxy success, appliance-local access, administrative changes, session activity, gateway-originated authentication, endpoint execution, internal expansion, and cloud access across separate telemetry sources.

·        Reliability of gateway identity, clustered-node mapping, virtual-appliance mapping, translated addresses, internal interfaces, original source addresses, requested destinations, session identifiers, account names, workstation names, destination systems, authentication protocols, and timestamps.

·        Scope of authentication material potentially exposed, including gateway administrator credentials, directory-integration accounts, LDAP credentials, service accounts, active sessions, cookies, authentication tokens, VPN context, certificates, TOTP seeds, user credentials, and privileged-access material.

·        Number and sensitivity of internal systems reachable from the gateway, including domain controllers, identity providers, management platforms, backup systems, virtualization infrastructure, storage systems, jump hosts, cloud resources, production applications, and regulated environments.

·        Ability to distinguish legitimate vendor support, health checks, monitoring, backup, restoration, hotfix activity, gateway administration, directory synchronization, vulnerability testing, troubleshooting, penetration testing, and incident response from attacker-driven behavior.

·        Need to rotate or review gateway administrator accounts, directory-service accounts, service accounts, remote-user credentials, authentication tokens, active sessions, certificates, API credentials, cloud identities, and multifactor enrollment or TOTP material.

·        Business disruption caused by emergency gateway isolation, remote-access suspension, vendor-access restrictions, credential rotation, TOTP reset, configuration restoration, gateway rebuild, clustered-node replacement, traffic rerouting, failover, and service restoration.

·        Scope of downstream endpoint activity, including suspicious shell, script, administrative-utility, credential-access, discovery, remote-management, or persistence behavior following gateway-originated access.

·        Scope of internal identity and network expansion, including authentication to domain controllers, identity systems, management systems, backup infrastructure, virtualization platforms, storage resources, administrative jump hosts, and multiple internal destinations.

·        Scope of AWS, Azure, or Google Cloud access originating from the gateway or compromised accounts, including access to identity, management, storage, backup, administrative, or workload resources.

·        Extent of security-control degradation, including logging disruption, audit manipulation, configuration cleanup, hotfix removal, service changes, route changes, file deletion, appliance reboot, evidence destruction, or post-patch continued activity.

·        Legal, privacy, regulatory, cyber-insurance, communications, customer, partner, executive, or board obligations triggered by credential exposure, identity compromise, remote-access disruption, cloud access, regulated-system exposure, data access, incomplete containment, or inability to prove non-exposure.

S6B — Compliance and Risk Context

Figure 1

Secure remote-access gateway compromise and identity pivoting executive risk model showing how suspicious external gateway interaction can progress into appliance-local service access, unauthorized gateway activity, authentication-material exposure, gateway-originated authentication, downstream endpoint execution, internal identity expansion, cloud-resource access, operational disruption, and enterprise-level business exposure.

Compliance Exposure Indicator

High

Risk Register Entry

Risk Title

Secure Remote-Access Gateway Compromise and Identity Pivoting Risk

Risk Description

Adversaries may exploit or abuse secure remote-access gateway behavior to move from external interaction into unintended appliance-local service access, unauthorized execution, configuration or hotfix manipulation, active-session exposure, credential or token access, TOTP-seed exposure, gateway-originated authentication, service-account abuse, endpoint execution, internal discovery, lateral movement, cloud-resource access, and broader identity-based expansion. This may increase business interruption, remote-access disruption, credential and multifactor exposure, domain and cloud trust loss, regulated-system exposure, legal and compliance review, cyber-insurance scrutiny, customer or partner notification analysis, and board-level concern around identity, remote-access, and gateway resilience. Compliance exposure should be driven by local evidence of suspicious gateway interaction, unauthorized appliance behavior, authentication-material access, unexplained gateway-originated authentication, downstream endpoint execution, internal expansion, cloud access, service disruption, or post-remediation activity, not by vulnerable firmware, CVE association, internet exposure, public exploit availability, KEV status, isolated WebSocket activity, or a standalone authentication anomaly.

Likelihood

High

Impact

Severe

Risk Rating

Critical

Annualized Risk Exposure

Estimated annualized exposure of $6M - $45M+ for materially exposed enterprise environments where internet-facing remote-access gateways, privileged internal connectivity, large remote-workforce dependency, directory-service integration, concentrated service-account use, incomplete gateway telemetry, weak VPN-session correlation, limited administrative logging, unreliable source attribution, poor workstation-name capture, short telemetry retention, or broad downstream access increase both incident likelihood and response burden. A realized severe event may exceed $40M - $200M+ when gateway compromise expands into credential theft, active-session hijacking, TOTP-seed exposure, directory-account abuse, domain authentication, privileged endpoint execution, cloud-resource access, lateral movement, persistent access, ransomware deployment, destructive activity, regulated-data exposure, widespread remote-access disruption, incomplete containment, cyber-insurance review, legal escalation, communications response, or board-level reporting.

S7 — Risk Drivers

·        Secure remote-access gateways operate at a high-trust boundary between untrusted external networks and internal identity, application, management, administrative, and cloud environments.

·        Gateways frequently maintain approved communication paths to domain controllers, directory services, identity providers, management systems, internal applications, monitoring platforms, backup infrastructure, and cloud-connected resources.

·        Suspicious proxy, relay, WebSocket, tunneling, or request-routing behavior can provide access to loopback, localhost, link-local, appliance-local, or otherwise restricted management and service interfaces.

·        Appliance compromise may expose active sessions, administrator credentials, directory-integration accounts, service accounts, authentication tokens, cookies, certificates, VPN context, and TOTP seed material.

·        Authentication originating from the gateway may appear trusted because the source appliance and integrated accounts are expected to communicate with internal identity services.

·        Multiple CVEs, implementation flaws, request encodings, proxy functions, administrative weaknesses, hotfix paths, and gateway vendors can produce the same operational compromise sequence.

·        Vulnerable firmware, internet exposure, public exploit information, proof-of-concept availability, and KEV status create urgency but cannot prove compromise or non-compromise without correlated gateway, administrative, session, identity, endpoint, network, and cloud evidence.

·        Patch completion can create false closure when pre-remediation appliance activity, credential exposure, authentication anomalies, endpoint execution, or internal expansion has not been reviewed.

·        Closed security appliances may not expose the process, command-line, memory, file, database, or session telemetry needed to confirm the technical exploitation mechanism directly.

·        Reverse proxies, NAT, load balancers, shared addresses, clustered nodes, and translated interfaces may obscure the original source, affected appliance, remote user, session, or downstream activity.

·        Legitimate vendor support, directory synchronization, gateway administration, health checks, hotfix activity, backup, restoration, monitoring, testing, and incident response can resemble portions of the attack chain without strong behavioral baselines.

·        Missing or inconsistent requested-destination fields, administrative events, session identifiers, workstation names, service-account mappings, authentication records, endpoint telemetry, network flows, cloud logs, or timestamps can increase investigation scope and cost.

·        Business exposure increases when affected gateways support privileged administrators, third-party vendors, remote employees, regulated services, identity systems, cloud management, production applications, or multiple internal environments.

·        Credential exposure, identity pivoting, domain authentication, endpoint execution, cloud access, production disruption, and incomplete containment can transform an appliance vulnerability into legal, regulatory, communications, cyber-insurance, customer, partner, executive, and board-level exposure.

S8 — Bottom Line for Executives

Secure remote-access gateway compromise and identity pivoting should be treated as a high-priority enterprise-trust, identity-protection, credential-security, remote-access, and operational-resilience risk because an internet-facing gateway can become a trusted path into internal identity systems, endpoints, administrative platforms, and cloud resources. The executive question is not only whether the gateway was patched, whether a public exploit exists, whether firmware was vulnerable, or whether suspicious WebSocket or proxy activity occurred; it is whether the organization can prove that external gateway interaction did not lead to appliance-local access, unauthorized gateway activity, session or credential exposure, TOTP-seed compromise, gateway-originated authentication, service-account abuse, endpoint execution, internal expansion, cloud-resource access, or continued activity after remediation. Response must focus on validating exposed and high-value gateways, preserving gateway and identity evidence, reviewing configuration and hotfix activity, correlating authentication with authorized sessions, assessing authentication-material exposure, examining endpoint and internal-network behavior, reviewing cloud activity, rotating exposed credentials, rebuilding gateways where required, and confirming that remote-access and identity trust have been restored before leadership relies on the affected environment.

S9 — Board-Level Takeaway

Secure remote-access gateway compromise becomes a board-level issue when an internet-facing system trusted to connect employees, administrators, vendors, and partners to internal resources can be converted into a platform for appliance manipulation, credential exposure, session hijacking, multifactor-material theft, identity abuse, internal authentication, endpoint execution, cloud access, or broader enterprise expansion. The risk is not simply that a gateway vulnerability existed, a patch was required, a public exploit was released, or suspicious proxy activity occurred; it is the possibility that adversaries used the trusted remote-access boundary to access authentication material, impersonate legitimate users or services, weaken gateway controls, reach identity and management systems, compromise endpoints, disrupt remote access, or expand into multiple internal and cloud environments. Leadership should require evidence that gateway inventory, vulnerable-state history, gateway and administrative logging, VPN-session correlation, identity telemetry, service-account governance, workstation attribution, credential and TOTP rotation, endpoint investigation, internal-network visibility, cloud review, gateway-rebuild capability, incident-response readiness, legal readiness, and business-continuity planning can support rapid and defensible decisions when remote-access gateway trust cannot be confirmed.

S10 — Threat Overview

Secure remote-access gateway compromise and identity pivoting describe adversary behavior in which external interaction with an internet-facing gateway may be converted into unintended access to appliance-local services, unauthorized gateway activity, authentication-material exposure, gateway-originated internal authentication, and downstream identity-based expansion. The enabling path may involve a proxy, relay, WebSocket, tunneling, request-routing, code-execution, administrative, configuration, hotfix, route, service, filesystem, session, credential, token, TOTP, or directory-integration weakness. Individual gateway vulnerabilities may provide entry points into this behavior class, but the durable enterprise risk is broader than any single CVE identifier, vendor, appliance version, exploit name, request path, proof-of-concept implementation, source address, or static indicator.

·        This is not only a vulnerable-firmware, CVE, KEV, public proof-of-concept, exploit-string, URI, WebSocket, source-IP, hotfix, configuration-change, or isolated-authentication model.

·        The core threat behavior is movement from suspicious external gateway interaction into appliance-local service access, unauthorized gateway control, authentication-material exposure, gateway-originated authentication, endpoint execution, internal expansion, or cloud-resource access.

·        Internet-facing remote-access gateways, VPN concentrators, secure access appliances, application-access brokers, and identity-integrated gateway platforms represent high-value targets because they maintain trusted paths between external users and internal systems.

·        The primary enterprise risk is reduced ability to determine whether suspicious gateway activity remained limited to probing, failed exploitation, authorized testing, troubleshooting, vendor support, or routine administration, or crossed into successful appliance compromise and identity pivoting.

·        Gateway HTTP, proxy, relay, WebSocket, administrative, configuration, VPN-session, authentication, directory, endpoint, firewall, NDR, and cloud telemetry may be incomplete or difficult to reconcile during active investigation.

·        Suspected gateway compromise can create uncertainty around administrator credentials, directory-integration accounts, active sessions, authentication tokens, TOTP seed material, service accounts, internal source-address trust, endpoint integrity, cloud access, and connected administrative systems.

·        Successful compromise may enable an adversary to authenticate from the gateway, use gateway-integrated accounts, reach domain controllers or identity systems, execute activity on downstream endpoints, access high-value infrastructure, or expand into cloud environments.

·        Public reporting on individual gateway vulnerabilities, exploitation campaigns, proof-of-concept releases, or KEV inclusion should increase urgency without narrowing the assessment into a single-CVE, vendor, actor, request-path, or IOC-only model.

S11 — Threat Classification and Type

Threat Type

Secure remote-access gateway compromise and identity pivoting risk.

Threat Sub-Type

External gateway exploitation, proxy or relay abuse, WebSocket or tunneling misuse, appliance-local service access, unauthorized command or script execution, configuration or hotfix manipulation, route or service modification, credential and session exposure, authentication-token or TOTP-material exposure, gateway-originated authentication, service-account abuse, downstream endpoint execution, internal discovery, lateral movement, and cloud-resource access.

Operational Classification

Internet-facing remote-access control-plane compromise, appliance-trust loss, authentication-material exposure, internal identity pivoting, and downstream enterprise expansion pathway.

Primary Function

Abuse an exposed secure remote-access gateway to move from external interaction into appliance-local access, unauthorized administrative control, session or credential exposure, gateway-originated authentication, valid-account use, endpoint execution, internal network access, or cloud-resource expansion, creating uncertainty around gateway integrity, remote-access trust, identity assurance, containment completeness, and downstream system exposure.

S12 — Campaign or Activity Overview

Figure 2

Secure remote-access gateway compromise and identity pivoting activity model showing suspicious external interaction, proxy or relay access to appliance-local services, unauthorized gateway activity, authentication-material exposure, gateway-originated authentication, downstream endpoint execution, internal identity expansion, and possible cloud-resource access.

This report assesses secure remote-access gateway compromise and identity pivoting as a durable behavior class rather than a single CVE, exploit release, vulnerable firmware version, gateway vendor, WebSocket path, proxy endpoint, source address, proof-of-concept repository, actor cluster, or patch event. The core activity pattern begins with suspicious interaction against an internet-facing remote-access gateway, progresses through unintended proxy, relay, WebSocket, tunneling, request-routing, administrative, or appliance-local service behavior, and may result in unauthorized gateway control. Successful compromise may then enable one or more conditional post-compromise behaviors, including credential or session exposure, gateway-originated authentication, service-account abuse, endpoint execution, internal discovery, lateral movement, persistence, security-control degradation, or access to AWS, Azure, or Google Cloud resources.

·        The activity is best understood as an enterprise-trust, identity-protection, credential-security, remote-access, and operational-resilience threat rather than a routine firmware-management issue or isolated web request.

·        Adversaries may begin with internet scanning, crafted HTTP requests, proxy manipulation, WebSocket interaction, encoded destinations, malformed paths, administrative-interface abuse, exposed APIs, stolen credentials, or exploitation of gateway-specific functionality.

·        Initial gateway interaction may reference loopback, localhost, link-local, appliance-local, internal, or otherwise prohibited management destinations.

·        Activity may remain limited to failed requests, gateway errors, unsuccessful protocol upgrades, service instability, vulnerability testing, authorized penetration testing, vendor support, or routine troubleshooting.

·        Successful gateway compromise may be indicated by confirmed appliance-local connection behavior, unauthorized command or script execution, unexpected configuration changes, hotfix removal, route modification, service changes, filesystem activity, or access to session and authentication material.

·        Authentication-material exposure may involve administrator credentials, directory-integration accounts, service accounts, active-session data, cookies, authentication tokens, VPN context, certificates, TOTP seeds, or user credentials.

·        Identity pivoting may involve NTLM, Kerberos, LDAP, SMB, or other authentication originating from the gateway without a corresponding authorized VPN session or approved service workflow.

·        Downstream activity may include suspicious endpoint process execution, internal discovery, remote-service access, access to domain controllers or management systems, lateral movement, credential validation, or communication with high-value infrastructure.

·        Ransomware monetization may occur when actors reuse gateway-derived credentials, sessions, TOTP material, service-account access, or gateway-originated authentication to support downstream intrusion, data access, ransomware preparation, extortion pressure, or victim communication after the initial gateway compromise.

·        Cloud-related expansion may involve unusual gateway-originated access to identity, management, storage, backup, administrative, or workload resources in AWS, Azure, or Google Cloud.

·        Actor names, exploit names, CVE references, KEV status, public proof-of-concept releases, request strings, filenames, hashes, or source addresses should enrich the assessment rather than replace local behavior-led evidence of gateway compromise and identity pivoting.

S13 — Targets and Exposure Surface

The exposure surface includes secure remote-access gateways and connected environments where an adversary can interact with an internet-facing access broker and where successful compromise could expose appliance control, credentials, active sessions, multifactor material, directory-service accounts, internal systems, endpoints, cloud resources, or privileged administrative paths. It also includes the local services, proxy functions, authentication relationships, management interfaces, downstream assets, and trust dependencies reachable from the gateway.

·        Internet-facing VPN gateways, secure remote-access appliances, application-access gateways, access brokers, remote administration portals, SSL VPN platforms, and identity-integrated remote-access systems.

·        Physical appliances, virtual appliances, clustered gateways, high-availability nodes, cloud-hosted gateway instances, translated gateway addresses, internal interfaces, and disaster-recovery gateway infrastructure.

·        Gateway HTTP, HTTPS, API, proxy, relay, WebSocket, tunneling, administrative, support, diagnostic, monitoring, update, and management interfaces.

·        Loopback, localhost, link-local, appliance-local, internal management, diagnostic, configuration, control, and service endpoints that should not be reachable from an external or unauthenticated context.

·        Administrative and control-plane functions involving hotfixes, configuration objects, routes, services, scripts, accounts, access rules, trusted connections, certificates, and filesystem paths.

·        Authentication and session resources, including gateway administrator credentials, directory-integration accounts, LDAP credentials, service accounts, active sessions, session databases, cookies, authentication tokens, certificates, VPN context, multifactor records, and TOTP seed material.

·        Domain controllers, LDAP services, Kerberos infrastructure, NTLM authentication services, identity providers, federation services, multifactor platforms, certificate services, and privileged-access systems connected to the gateway.

·        Internal applications, administrative portals, jump hosts, management servers, backup systems, virtualization platforms, storage systems, databases, monitoring platforms, and regulated or production-critical resources reachable through the gateway.

·        Endpoint systems that may receive gateway-originated network access followed by shell, script, administrative-utility, credential-access, discovery, remote-management, or persistence activity.

·        AWS, Azure, and Google Cloud identity, management, storage, backup, administrative, and workload resources reachable from gateway addresses or compromised accounts.

·        Remote employees, privileged administrators, third-party vendors, contractors, support personnel, business partners, service accounts, and automated integrations that depend on the gateway.

·        Environments with incomplete gateway inventory, poor clustered-node mapping, weak source-address preservation, missing requested-destination fields, insufficient administrative logging, incomplete VPN-session records, unreliable workstation names, stale service-account mappings, short telemetry retention, or limited gateway-to-cloud attribution.

·        Environments where gateway administration, directory integration, monitoring, health checks, vendor support, backup, restoration, vulnerability testing, and incident response are not sufficiently documented or baselined.

S14 — Sectors / Countries Affected

Sectors Affected

·        Technology, SaaS, software, telecommunications, hosting, cloud-service, managed-service, and digital-platform organizations operating internet-facing remote-access gateways and large distributed workforces.

·        Financial services, insurance, banking, payment-adjacent, legal, consulting, and professional-services organizations using remote-access gateways for privileged administration, regulated applications, vendor connectivity, or workforce access.

·        Healthcare, life sciences, public-sector, education, research, nonprofit, and regulated-service organizations using gateway infrastructure to provide remote access to sensitive applications, identity systems, data platforms, and operational environments.

·        Retail, e-commerce, hospitality, travel, transportation, logistics, media, marketing, and customer-facing service organizations dependent on remote access for distributed operations, support, administration, and business continuity.

·        Manufacturing, industrial, energy, utilities, supply-chain, aerospace, engineering, and supplier-dependent organizations using remote-access gateways for plant support, vendor access, engineering systems, operational administration, and geographically distributed infrastructure.

·        Organizations operating privileged remote administration, third-party support access, hybrid-cloud connectivity, centralized identity services, backup platforms, virtualization environments, storage systems, and multi-site infrastructure.

·        Large enterprises, distributed organizations, cloud-forward organizations, government contractors, managed hosting customers, and organizations with concentrated remote-access, service-account, directory-integration, or multifactor dependencies.

Countries Affected

·        Global.

·        Exposure is not limited to a single country or region because remote-access gateways, VPN platforms, secure access appliances, hybrid-cloud environments, distributed workforces, and third-party support models are deployed globally.

·        Countries with large populations of internet-facing enterprise infrastructure, managed services, distributed workforces, critical infrastructure, cloud-connected environments, and regional data centers may face elevated operational exposure.

·        Country-specific impact should be assessed by gateway exposure, remote-workforce dependency, privileged-access use, third-party connectivity, identity-system integration, internal reachability, regulatory obligations, telemetry maturity, and incident-response capability rather than geography alone.

S15 — Adversary Capability Profiling

Capability Level

Moderate to High

Technical Sophistication

Adversaries require enough technical capability to identify an exposed remote-access gateway, understand or test its proxy, relay, WebSocket, API, administrative, or request-routing behavior, and determine whether external interaction can reach appliance-local or internal services. Lower-complexity activity may involve public proof-of-concept reuse, commodity exploit replay, automated scanning, known endpoint targeting, fixed request patterns, or direct use of published gateway-specific techniques. Higher-capability activity may involve custom request encoding, chained gateway weaknesses, appliance-specific service discovery, authentication-material extraction, stealthy configuration manipulation, selective use of gateway-integrated accounts, session hijacking, multifactor-material theft, log cleanup, persistence, and coordinated identity pivoting into internal or cloud environments.

Infrastructure Maturity

Moderate

Infrastructure maturity varies by activity pattern. Lower-maturity activity may rely on direct scanning, public exploit code, commodity hosting, single-use infrastructure, common proxy services, or publicly documented request patterns. Higher-maturity activity may use distributed scanning, compromised infrastructure, rotating source addresses, layered proxying, encrypted tasking, custom exploit delivery, separate credential-use infrastructure, cloud-hosted redirectors, stolen sessions, trusted service accounts, and activity designed to resemble vendor support, remote administration, directory synchronization, monitoring, or legitimate user access.

Operational Scale

Single exposed gateway to multi-environment identity and infrastructure compromise

Operational scale ranges from suspicious interaction with one gateway to broader enterprise compromise when multiple appliances, clustered nodes, sites, user populations, service accounts, identity systems, cloud environments, or administrative networks share vulnerable configurations or trust relationships. Within one organization, scale can expand from gateway exploitation into authentication-material exposure, active-session abuse, directory-service account use, endpoint execution, internal discovery, lateral movement, cloud-resource access, remote-access disruption, destructive activity, or multi-system compromise.

Escalation Likelihood

High

Escalation likelihood is high when suspicious external gateway interaction is followed by successful appliance-local connection behavior, unauthorized command or script execution, configuration or hotfix manipulation, access to session or authentication material, gateway-originated authentication, unfamiliar service-account use, downstream endpoint execution, internal discovery, high-value system access, or cloud-resource activity. Escalation likelihood increases when affected gateways are internet-facing, unpatched, identity-integrated, highly trusted, weakly monitored, connected to privileged systems, dependent on shared service accounts, used by a large remote workforce, or responsible for vendor, administrator, or business-critical access.

S16 — Targeting Probability Assessment

Overall Targeting Probability

High

Targeting Drivers

·        Secure remote-access gateways are intentionally exposed to the internet and commonly provide trusted access to internal applications, identity services, management systems, and cloud resources.

·        Gateways frequently hold or process administrator credentials, directory-integration accounts, active sessions, authentication tokens, certificates, VPN context, user credentials, and multifactor material.

·        Public exploit knowledge, proof-of-concept availability, KEV designation, repeatable request patterns, commodity automation, and widely deployed gateway platforms can lower the barrier for opportunistic adversaries.

·        Successful gateway compromise can provide a trusted source address and direct communication path to domain controllers, identity systems, internal applications, management platforms, backup infrastructure, virtualization systems, storage systems, and cloud resources.

·        Attackers benefit from environments where requested destinations, appliance-local communication, administrative attribution, VPN-session context, service-account mapping, workstation names, or original source addresses are not reliably preserved.

·        Closed security appliances may lack the endpoint, process, memory, file, and database telemetry needed to determine precisely what occurred after exploitation.

·        Patch completion, appliance reboot, configuration restoration, gateway replacement, and short log retention can destroy or obscure evidence needed to establish whether compromise preceded remediation.

·        Legitimate vendor support, remote administration, health checks, directory synchronization, monitoring, backup, restoration, vulnerability testing, and incident response can make attacker-driven activity harder to distinguish without strong baselines.

·        Targeting probability should be assessed through internet exposure, vulnerable-state presence, gateway criticality, identity integration, internal reachability, credential concentration, remote-workforce dependency, telemetry maturity, and local evidence of gateway-compromise behavior rather than CVE count or exploit names alone.

Most Likely Targets

·        Internet-facing, partner-reachable, cloud-hosted, production, disaster-recovery, and high-availability secure remote-access gateways.

·        VPN concentrators, SSL VPN appliances, application-access gateways, secure access brokers, remote administration portals, and identity-integrated remote-access systems.

·        Gateways used by privileged administrators, third-party vendors, contractors, support personnel, remote employees, or business partners.

·        Appliances connected to domain controllers, identity providers, LDAP services, multifactor systems, certificate services, privileged-access platforms, and administrative networks.

·        Gateways with trusted access to management systems, backup infrastructure, virtualization platforms, storage systems, jump hosts, cloud resources, production applications, or regulated environments.

·        Gateway clusters, virtual appliances, translated interfaces, internal gateway addresses, and remote-access infrastructure with incomplete node mapping or weak source attribution.

·        Environments using shared directory-integration accounts, broadly privileged service accounts, reusable administrative credentials, long-lived sessions, weak token controls, or recoverable TOTP seed material.

·        Environments with delayed patching, incomplete vulnerable-state validation, limited gateway logging, weak VPN-session correlation, unreliable workstation attribution, poor authentication baselines, short telemetry retention, or insufficient gateway-rebuild capability.

S17 — MITRE ATT&CK Chain Flow Mapping

Stage 1 — Exploit Public-Facing Application (T1190)

The adversary targets an internet-facing secure remote-access gateway through crafted HTTP, API, proxy, relay, WebSocket, administrative, or request-routing activity intended to exploit an exposed gateway function.

·        T1190 — Exploit Public-Facing Application

Stage 2 — Command and Appliance Control (T1059)

Following successful gateway exploitation, the adversary may use command interpreters, scripts, utilities, administrative functions, service controls, routes, or configuration mechanisms to alter gateway behavior or execute unauthorized actions.

·        T1059 — Command and Scripting Interpreter

Stage 3 — Web Session Cookie Access (T1539)

The adversary may access or steal web-session cookies or equivalent cookie-based authenticated session material held or processed by the compromised gateway.

·        T1539 — Steal Web Session Cookie

Stage 4 — Valid Account Use (T1078)

The adversary may use exposed gateway administrator, directory-integration, service, remote-user, or other valid accounts to authenticate to internal identity services, applications, endpoints, or cloud resources.

·        T1078 — Valid Accounts

Stage 5 — Alternate Authentication Material Use (T1550)

The adversary may use stolen application access tokens, password hashes, Kerberos tickets, web-session cookies, or other supported alternate authentication material to access resources without relying on the associated plaintext password or repeating the normal authentication process.

·        T1550 — Use Alternate Authentication Material

Stage 6 — Remote Services and Internal Expansion (T1021)

The adversary may use compromised accounts, sessions, or gateway trust to access endpoints, domain infrastructure, management systems, backup platforms, virtualization environments, storage systems, jump hosts, or other internal resources.

·        T1021 — Remote Services

S18 — Attack Path Narrative (Signal-Aligned Execution Flow)

Secure remote-access gateway compromise and identity pivoting begin when an adversary interacts with an internet-facing gateway through a crafted HTTP request, API call, proxy function, relay mechanism, WebSocket connection, administrative interface, or other exposed access path. The core attack path is movement from suspicious external interaction into unintended appliance-local service access or unauthorized gateway control. Successful compromise may then enable one or more conditional post-compromise behaviors, including authentication-material exposure, gateway-originated authentication, endpoint execution, internal expansion, and cloud-resource access. Broad domain compromise, ransomware deployment, destructive activity, widespread data theft, or multi-cloud takeover remain conditional outcomes unless supporting telemetry confirms them.

Stage 1: Suspicious External Gateway Interaction

The adversary targets an internet-facing secure remote-access gateway through crafted HTTP, API, proxy, relay, WebSocket, tunneling, administrative, or request-routing activity. Observable evidence may include requests containing loopback, localhost, link-local, appliance-local, internal, encoded, malformed, or otherwise prohibited destination values; repeated connection attempts; unusual URI paths; protocol-upgrade requests; alternate ports; or traffic inconsistent with normal remote-access use. This stage does not establish successful exploitation by itself because vulnerability testing, vendor support, monitoring, troubleshooting, and ordinary gateway errors may generate similar activity. It becomes material when suspicious interaction aligns with successful proxy or relay establishment, appliance-local service access, unauthorized administrative behavior, or subsequent internal authentication.

Stage 2: Appliance-Local Service Access and Gateway Control

The adversary abuses gateway proxy, relay, WebSocket, request-routing, administrative, or service functionality to reach loopback, localhost, link-local, appliance-local, internal management, control, diagnostic, or otherwise restricted services. Observable evidence may include successful protocol upgrades, proxy connection success, relay-session creation, access to local management interfaces, unusual service communication, command or script execution, hotfix removal, configuration changes, route modification, service changes, temporary-file activity, or suspicious filesystem interaction. This stage becomes the central compromise point when external gateway interaction produces confirmed appliance-local access or unauthorized gateway activity outside an approved maintenance, support, testing, or incident-response workflow.

Stage 3: Authentication-Material and Session Exposure

Following successful gateway compromise, the adversary may access administrator credentials, directory-integration accounts, service accounts, active-session data, cookies, authentication tokens, certificates, VPN context, multifactor records, TOTP seed material, or other authentication resources held or processed by the appliance. Observable evidence may include unusual reads, exports, copies, archives, permission changes, configuration access, session-database activity, credential-store interaction, token use, session reuse, or unexplained authentication involving gateway-associated identities. This stage increases business risk because exposed authentication material may allow the adversary to impersonate users, services, administrators, or trusted gateway functions beyond the original appliance.

Stage 4: Gateway-Originated Authentication and Identity Pivoting

The adversary may use the compromised gateway or exposed identities to authenticate to domain controllers, LDAP services, Kerberos infrastructure, NTLM services, SMB resources, identity providers, internal applications, or administrative systems. Observable evidence may include successful authentication originating from the gateway without a corresponding authorized VPN session, use of gateway-integrated service accounts from unfamiliar workstation names or access paths, authentication to unusual destinations, use of unexpected protocols, activity outside approved service windows, or failed-to-success authentication sequences. This stage becomes high priority when the gateway source, account, destination, protocol, workstation, session, and timing cannot be reconciled with expected remote-access or directory-integration behavior.

Stage 5: Downstream Endpoint and Internal Expansion

The adversary may use gateway trust, exposed credentials, valid accounts, sessions, or alternate authentication material to reach endpoints, management systems, jump hosts, domain infrastructure, backup platforms, virtualization environments, storage systems, or other internal resources. Observable evidence may include gateway-originated network access followed by shell, scripting-engine, administrative-utility, credential-access, discovery, remote-management, or persistence activity on a protected endpoint; new or rare internal destinations; destination fan-out; unusual ports or protocols; repeated failed connections; or access to high-value infrastructure. This stage becomes materially significant when downstream behavior aligns with suspicious gateway activity by gateway identity, account, session, destination, endpoint, or bounded time window.

Stage 6: Cloud and Multi-Environment Expansion

The adversary may use compromised accounts, sessions, tokens, certificates, gateway addresses, or trusted access paths to reach AWS, Azure, or Google Cloud identity, management, storage, backup, administrative, or workload resources. Observable evidence may include unusual cloud sign-ins, API activity, new or rare resource access, access to high-value services, activity from gateway-associated addresses, role use, storage access, backup interaction, management-plane activity, or cross-environment authentication. This stage becomes high priority when cloud activity follows suspicious gateway interaction, authentication-material exposure, gateway-originated authentication, or internal expansion and cannot be explained by approved hybrid-cloud administration, monitoring, backup, support, or incident-response activity.

S19 — Attack Chain Risk Amplification Summary

Secure remote-access gateway compromise amplifies risk because it converts an exposed internet-facing access broker into a trusted platform for appliance-local access, authentication-material exposure, internal authentication, endpoint activity, and downstream infrastructure expansion. The chain becomes materially more dangerous when suspicious gateway interaction is followed by successful appliance-local connection behavior, unauthorized gateway modification, session or credential access, unexplained authentication, endpoint execution, internal discovery, or cloud-resource access.

·        Internet-facing gateway exposure increases risk because adversaries can directly interact with proxy, relay, WebSocket, API, administrative, and request-routing functions from untrusted networks.

·        Suspicious external interaction increases concern when requests reference loopback, localhost, link-local, appliance-local, internal, encoded, malformed, or prohibited destinations.

·        Successful proxy, relay, or protocol-upgrade behavior amplifies risk because it may indicate that an external request reached an appliance-local or restricted service.

·        Unauthorized gateway control increases impact because the adversary may alter configuration, routes, services, hotfix state, accounts, access rules, scripts, or filesystem content.

·        Authentication-material exposure increases business risk when affected resources include administrator credentials, directory-integration accounts, service accounts, active sessions, tokens, cookies, certificates, VPN context, or TOTP seed material.

·        Gateway-originated authentication increases uncertainty because internal identity systems may treat the gateway address and integrated accounts as trusted or expected.

·        Service-account abuse increases scope when directory-integrated identities are used from unfamiliar workstation names, systems, destinations, protocols, or access paths.

·        Endpoint execution amplifies impact when gateway-originated access is followed by shell, script, administrative-utility, credential-access, discovery, remote-management, or persistence activity.

·        Internal expansion increases risk when the gateway reaches domain controllers, management systems, jump hosts, backup platforms, virtualization infrastructure, storage systems, or multiple unusual destinations.

·        Cloud-connected environments increase exposure when compromised identities, tokens, sessions, certificates, or gateway addresses are used to access AWS, Azure, or Google Cloud resources.

·        Shared gateway clusters, service accounts, identity integrations, remote-user populations, and downstream trust relationships can extend one compromise pattern across multiple appliances, sites, systems, or environments.

·        Closed appliance architecture increases investigation difficulty because process, command-line, memory, file, database, and credential-access telemetry may be unavailable.

·        NAT, reverse proxies, load balancers, shared addresses, clustered nodes, and translated interfaces may obscure the original source, affected appliance, remote user, or downstream action.

·        Patching, rebooting, restoring configuration, or replacing a gateway may remove the vulnerable state while also eliminating evidence needed to determine whether compromise occurred before remediation.

·        Business exposure increases when affected gateways support privileged administrators, third-party vendors, remote workforces, regulated applications, production systems, identity services, or business-continuity functions.

·        Response burden increases because teams may need to isolate and rebuild gateways, rotate credentials and tokens, reset TOTP material, review directory accounts, investigate endpoints, validate internal activity, examine cloud access, and prove that remote-access trust was not abused.

S20 — Tactics, Techniques, and Procedures

Figure 3

Suspicious External Gateway Interaction

Adversaries may target secure remote-access gateways through crafted HTTP requests, API calls, proxy functions, relay mechanisms, WebSocket connections, administrative interfaces, encoded destinations, malformed paths, alternate ports, or repeated connection attempts. Observable behavior may include external requests referencing loopback, localhost, link-local, appliance-local, internal, or prohibited management destinations. This behavior becomes risk-relevant when it aligns with successful connection establishment, appliance-local service access, unauthorized gateway activity, or subsequent internal authentication.

Appliance-Local Service Access

Adversaries may abuse gateway proxy, relay, WebSocket, tunneling, request-routing, diagnostic, or management functionality to reach services that should not be externally accessible. This behavior becomes high priority when a suspicious request is followed by HTTP 101 responses, successful proxy connections, relay-session creation, access to local management functions, or evidence of communication with loopback, link-local, appliance-local, or restricted internal services.

Unauthorized Gateway Control

Following successful gateway access, adversaries may execute commands or scripts, remove hotfixes, alter configuration, modify routes, create or change services, add accounts or access rules, manipulate trusted connections, or modify filesystem content. This behavior becomes materially significant when high-risk changes occur outside approved administrator, maintenance, support, restoration, testing, or incident-response workflows.

Credential, Session, Token, and TOTP Access

Adversaries may access gateway administrator credentials, directory-integration accounts, service accounts, active-session data, cookies, authentication tokens, certificates, VPN context, multifactor records, or TOTP seed material. This behavior becomes high risk when session or authentication-resource access follows suspicious gateway activity and is followed by unexplained authentication, account use, endpoint access, internal expansion, or cloud activity.

Gateway-Originated Authentication

Adversaries may authenticate from a compromised gateway to domain controllers, LDAP services, Kerberos infrastructure, NTLM services, SMB resources, identity providers, internal applications, or administrative systems. This behavior becomes high priority when no matching authorized VPN session or approved service workflow exists and the account, workstation name, destination, protocol, access path, or timing deviates from the gateway baseline.

Valid Account and Alternate Authentication Material Use

Adversaries may use exposed administrator, service, directory-integration, remote-user, cloud, or application accounts, along with stolen sessions, tokens, certificates, cookies, or other authentication artifacts, to access internal or cloud resources. This behavior becomes materially significant when valid identities or authentication material are used from unexpected sources, systems, workstation names, destinations, protocols, or time windows following suspicious gateway activity.

Downstream Endpoint Execution

Adversaries may use gateway-originated access to reach protected endpoints and execute shells, scripts, administrative utilities, credential-access tools, discovery commands, remote-management processes, or persistence mechanisms. This behavior becomes high risk when the gateway connection and suspicious process activity occur on the same endpoint within a bounded time window and cannot be explained by approved remote administration, software deployment, vulnerability scanning, troubleshooting, or incident response.

Internal Discovery and Expansion

Adversaries may use a compromised gateway or exposed identities to reach domain controllers, management systems, backup infrastructure, virtualization platforms, storage systems, jump hosts, or other internal resources. Observable behavior may include new or rare destinations, unusual ports or protocols, destination fan-out, repeated failed connections, remote-service use, credential validation, directory discovery, or high-value system access. This behavior becomes materially significant when it follows suspicious gateway activity and exceeds the gateway’s approved communication role.

Cloud Resource Access

Adversaries may use gateway-associated addresses, valid accounts, sessions, tokens, certificates, or other authentication material to reach AWS, Azure, or Google Cloud identity, management, storage, backup, administrative, or workload resources. This behavior becomes high risk when activity is new, rare, unapproved, role-inconsistent, or directed toward high-value services following suspicious gateway or identity activity.

Operational Blending With Gateway Administration and Remote Access

Adversaries may blend malicious behavior into legitimate gateway administration, vendor support, remote-access sessions, directory synchronization, health checks, monitoring, backup, restoration, troubleshooting, vulnerability testing, penetration testing, or incident-response activity. Detection and response require correlation across gateway identity, source address, requested destination, administrative action, account, workstation name, VPN session, authentication protocol, endpoint, internal destination, cloud resource, and bounded time window rather than reliance on one event.

Post-Remediation Access and Trust Validation Failure

Adversaries may retain access through exposed credentials, active sessions, stolen tokens, certificates, TOTP material, modified services, altered routes, unauthorized accounts, persistence mechanisms, or downstream identities after patching, rebooting, restoring configuration, or replacing the gateway. This behavior becomes high priority when unexplained authentication, endpoint execution, internal access, or cloud activity continues after remediation and cannot be tied to approved recovery or validation work.

S20A — Adversary Tradecraft Summary

Secure remote-access gateway compromise and identity pivoting target the trust relationship between internet-facing gateway functions, appliance-local services, administrative controls, sessions, credentials, multifactor material, directory integrations, valid accounts, downstream endpoints, internal systems, and cloud resources. The adversary objective is to convert external gateway interaction into appliance control and broader identity or infrastructure access while blending into legitimate remote-access, administration, support, and directory-service activity.

·        The core tradecraft pattern is suspicious external gateway interaction followed by appliance-local service access or unauthorized gateway control, with possible follow-on authentication-material exposure, gateway-originated authentication, endpoint execution, internal expansion, or cloud access.

·        The behavior is not dependent on a single CVE, vendor, appliance model, firmware version, exploit name, request path, WebSocket endpoint, source address, proof-of-concept repository, actor name, or static indicator.

·        Adversaries may use crafted HTTP requests, API calls, proxy manipulation, relay activity, WebSocket connections, encoded destinations, malformed paths, administrative interfaces, scripts, commands, configuration changes, route changes, service changes, or filesystem interaction.

·        The strongest operational risk occurs when appliance compromise affects gateways connected to domain controllers, identity providers, privileged-access systems, management platforms, backup infrastructure, virtualization environments, storage systems, cloud control planes, production applications, or regulated services.

·        Credential, session, token, certificate, and TOTP exposure may extend the incident beyond the appliance into directory, endpoint, application, administrative, and cloud environments.

·        Gateway-originated authentication may blend into normal directory integration because internal systems expect the appliance and its service accounts to communicate with identity services.

·        Endpoint execution, internal expansion, and cloud access increase uncertainty over whether compromise remained limited to the gateway or became a broader enterprise identity incident.

·        Closed appliance architecture, incomplete session attribution, shared addresses, NAT, clustered nodes, and short retention can prevent direct reconstruction of the compromise sequence.

·        Detection requires visibility into the external interaction that begins the chain and the appliance-local, administrative, authentication-material, VPN-session, identity, endpoint, internal-network, and cloud evidence that confirms or disproves broader impact.

·        Response requires treating suspected gateway compromise as an appliance-trust, credential-exposure, identity-pivoting, endpoint, cloud, and containment-validation incident, not only as a vulnerable-firmware or patch-management issue.

·        The behavior remains durable because the adversary objective is to convert an exposed remote-access gateway into trusted internal access regardless of the specific vulnerability, request structure, exploit implementation, appliance vendor, account, or downstream destination used.

S21 — Detection Strategy Overview

Detection Philosophy

Detect secure remote-access gateway compromise through correlated gateway, web, appliance, network, authentication, directory-service, and Windows service/process behavior where applicable. Do not depend on CVE identifiers, exploit names, source IP addresses, fixed indicators, or vulnerable-version status alone. The durable detection model is suspicious external gateway interaction followed by appliance-local service access, unauthorized appliance activity, authentication-material exposure, gateway-originated internal authentication, or downstream identity pivoting. For Windows RRAS systems, strengthen exploit-to-execution confidence by correlating suspicious externally sourced activity with process execution positively attributed to the RemoteAccess service.

Primary Detection Anchors

·        External requests that cause a remote-access gateway to connect to loopback, localhost, appliance-local, link-local, or unauthorized internal services.

·        Suspicious WebSocket, proxy, relay, or tunneling activity involving gateway functions that normally broker remote user access.

·        Access to administrative, control, or service interfaces that should not be reachable from an external or unauthenticated context.

·        Unexpected command, script, shell, utility, or service execution within the gateway appliance context.

·        Suspicious child-process execution from a process positively attributed to the Windows RemoteAccess service on an RRAS server.

·        Unauthorized hotfix, configuration, route, service, or filesystem changes.

·        Access to stored credentials, active-session data, authentication tokens, TOTP seed material, or directory-integration credentials.

·        Authentication from the gateway’s internal address without a corresponding authorized VPN or remote-access session.

·        Use of gateway-integrated service accounts from unfamiliar workstation names, hosts, source contexts, or access paths.

·        Gateway-originated authentication to domain controllers, identity services, management systems, or other internal resources following suspicious appliance activity.

Detection Prioritization Model

Prioritize activity where suspicious external gateway interaction is followed by appliance-local service access, unauthorized execution, configuration change, authentication-material access, or internal authentication. For Windows RRAS systems, prioritize externally sourced activity followed by suspicious execution from a process positively attributed to the RemoteAccess service. Treat vulnerable firmware or software, internet exposure, KEV status, public exploit information, isolated proxy requests, RRAS service faults, generic svchost.exe activity, and individual authentication anomalies as exposure or supporting context unless joined to a credible gateway-compromise or identity-pivoting sequence.

Correlation Strategy (Strict Enforcement)

Do not promote a single HTTP request, WebSocket connection, gateway error, RRAS service fault, vulnerable-state finding, configuration event, process event, or authentication event to high-confidence compromise without correlation by appliance or host, source address, destination service, request path, user, service account, session identifier, workstation name, service identity, parent-process relationship, internal destination, administrative workflow, or bounded time window. High-confidence detection requires a sequence connecting suspicious gateway interaction to unauthorized appliance behavior, validated RRAS service-context execution, authentication-material access, gateway-originated authentication, or internal identity pivoting. Generic svchost.exe activity must not be treated as RRAS-specific execution without validated RemoteAccess service attribution.

Telemetry Prioritization

Prioritize remote-access gateway web logs, appliance audit logs, administrative logs, service logs, configuration-change records, authentication logs, VPN session records, directory-service logs, domain-controller telemetry, firewall logs, NDR, and network-flow data. For Windows RRAS systems, also prioritize Windows service and process-creation telemetry sufficient to identify the RemoteAccess service process and its child-process activity. Accurate appliance or host identity, source and destination addressing, request path, session context, service-account identity, workstation name, authentication type, service identity, parent-process context, and timestamp alignment are required for strong correlation.

Detection Design Constraints

Avoid detection designs based only on CVE identifiers, exploit names, fixed source IP addresses, filenames, hashes, firmware or software versions, isolated URL strings, generic WebSocket traffic, ordinary gateway administration, generic svchost.exe activity, isolated RRAS service faults, or standalone authentication anomalies. Detection must remain useful when attackers change request encoding, endpoint paths, tooling, command syntax, staging locations, accounts, or downstream destinations while preserving the same gateway-compromise and identity-pivoting behavior.

Baseline and Deployment Requirements

Baseline approved gateway administration, vendor support, health checks, configuration changes, hotfix activity, backup and restoration, directory integration, LDAP service-account use, VPN session behavior, internal service communication, monitoring, and incident-response access. For Windows RRAS systems, baseline normal RemoteAccess service behavior and maintain current service-to-process attribution so suspicious child execution can be distinguished from unrelated svchost.exe activity. Validate source-address preservation, session attribution, appliance-to-service-account mapping, gateway-to-domain-controller relationships, workstation-name capture, firmware or software inventory, log completeness, and time synchronization before promoting correlation logic to alert mode.

Variant Resilience Requirements

Rules should remain effective for future remote-access gateway exploitation paths that produce the same operational sequence: suspicious external interaction, unintended appliance-local service access, unauthorized execution, configuration manipulation, authentication-material exposure, gateway-originated internal authentication, or identity-based expansion. Windows RRAS detections should remain behavior-led and should not depend on one RRAS CVE, exploit payload, process identifier, or source address.

Operational Detection Model

Run detections in hunt mode first. Validate gateway log parsing, request-path visibility, WebSocket and proxy-event capture, appliance identity, administrative-event coverage, configuration-change logging, VPN session correlation, service-account mapping, domain-controller authentication fields, and timestamp precision. For Windows RRAS systems, also validate RemoteAccess service-process attribution and process-creation telemetry before alert promotion. Promote to alert mode after approved gateway operations, RRAS service behavior, and expected directory-service behavior are baselined.

Explicit Non-Deployment Guardrails

Do not deploy CVE-name, exploit-name, firmware or software-version, source-IP, process-name, or static-string rules as standalone compromise detection. Do not claim successful gateway compromise from an isolated proxy request, WebSocket connection, gateway error, RRAS service fault, svchost.exe event, configuration event, authentication event, vulnerable-state finding, or KEV designation. Do not attribute internal authentication or directory activity to gateway exploitation without appliance or host, account, session, source, destination, service, process, or time-window linkage. Do not treat svchost.exe as RRAS-specific execution unless the process has been positively associated with the RemoteAccess service.

S22 — Primary Detection Signals

Figure 4

Primary Detection Signals

·        External requests to gateway proxy or relay functions that reference loopback, localhost, appliance-local, link-local, or unauthorized internal destinations.

·        Successful protocol upgrades, proxy connections, or relay activity associated with suspicious external requests.

·        Access to appliance-local administrative, control, or service interfaces from an external or unauthenticated context.

·        Unexpected command, script, shell, utility, or service execution on the gateway.

·        Suspicious child-process execution from a process positively attributed to the Windows RemoteAccess service on an RRAS server.

·        Unauthorized hotfix-removal, configuration, route, service, or filesystem activity.

·        Access to stored credentials, active-session data, authentication tokens, TOTP seed material, or directory-integration credentials.

·        NTLM, Kerberos, LDAP, or other internal authentication originating from the gateway without a corresponding authorized remote-access session.

·        Gateway-integrated service-account use associated with unfamiliar workstation names, devices, source patterns, or internal destinations.

·        Authentication to domain controllers or identity systems shortly after suspicious gateway activity.

·        Gateway-originated internal discovery, credential use, remote access, or lateral movement following suspected appliance compromise.

Supporting Detection Signals

·        Internet exposure and vulnerable firmware or software on an affected or similarly exposed remote-access gateway.

·        Requests involving unusual proxy destinations, encoded host values, alternate ports, malformed paths, or repeated connection attempts.

·        HTTP 101 responses or other successful connection indicators associated with abnormal proxy or WebSocket requests.

·        Gateway errors, service instability, unexpected restarts, or administrative events near suspicious external activity.

·        RRAS service faults or restarts near suspicious externally sourced activity.

·        Configuration changes outside approved maintenance, patching, support, or incident-response windows.

·        New or altered routes, services, accounts, access controls, or trusted connections.

·        Unusual reads, exports, copies, or archives involving session, credential, token, or configuration data.

·        Internal firewall or NDR activity showing the gateway reaching systems it does not normally access.

·        Service-account use outside established gateway functions or approved directory-integration behavior.

·        Authentication failures followed by successful access from the gateway or an associated account.

Exploit Attempt and Instability Signals

·        Repeated requests to gateway proxy, relay, or WebSocket functions using loopback, localhost, appliance-local, link-local, or unusual internal targets.

·        Repeated malformed, encoded, or path-manipulated requests directed at remote-access gateway interfaces.

·        Failed-to-success connection patterns involving gateway-local services.

·        Unexpected gateway or RRAS service faults, process restarts, appliance reboots, or recovery activity near suspicious requests.

·        Suspicious externally sourced activity against an RRAS server followed by child-process execution from the validated RemoteAccess service process.

·        Hotfix-removal or configuration events involving unexpected paths, traversal patterns, scripts, or temporary files.

·        Multiple similar exploitation attempts against one or more gateways within a bounded time window.

·        Exploit-specific strings or indicators treated only as supporting evidence when correlated with gateway behavior.

Outbound Communication Signals

·        Gateway connections to internal systems, directory services, management interfaces, or administrative ports that are not part of approved operation.

·        Gateway-originated authentication or network access without an associated authorized VPN session.

·        Communication from the gateway to unusual external destinations following suspicious appliance activity.

·        Unexpected SSH, SMB, LDAP, Kerberos, NTLM, RDP, or other management and authentication traffic from the gateway.

·        Repeated internal connection attempts, discovery behavior, or service enumeration originating from the appliance.

·        Network activity inconsistent with approved updates, monitoring, directory integration, support, backup, or remote-access workflows.

Persistence and Post-Exploitation Signals (Conditional)

·        Unauthorized routes, services, accounts, access rules, configuration objects, or scripts added to the appliance.

·        Changes to gateway configuration files or administrative settings outside approved workflows.

·        Access to or export of session databases, stored credentials, TOTP seeds, tokens, or directory-integration credentials.

·        Use of stolen gateway-held authentication material after suspicious appliance activity.

·        Log deletion, configuration cleanup, temporary-file removal, service restart, or appliance reboot intended to reduce forensic visibility.

·        Continued suspicious authentication or access after the gateway has been patched without being rebuilt or fully investigated.

Lateral Movement and Expansion Signals (Conditional)

·        Domain-controller or identity-service authentication originating from the gateway following suspicious appliance activity.

·        Use of gateway LDAP or service-account credentials from unfamiliar workstation names, systems, or access paths.

·        Internal authentication without a corresponding VPN, remote-access, or approved administrative session.

·        Access from the gateway or compromised account to identity, management, backup, virtualization, storage, or other high-value services.

·        Remote-service use, administrative access, credential validation, or directory discovery following gateway compromise.

·        Similar account, workstation-name, destination, or authentication patterns across multiple internal systems.

Signal Usage Constraints

Do not treat any single signal as proof of compromise. Promote confidence only when signals align by gateway or RRAS host, source address, destination, request path, protocol, session, user, service account, workstation name, service identity, parent-process context, internal resource, administrative workflow, or bounded time window. Treat internet exposure, vulnerable firmware or software, KEV status, public exploit information, RRAS service faults, generic svchost.exe activity, and static indicators as urgency or supporting inputs rather than standalone confirmation.

S23 — Telemetry Requirements

Endpoint and Process Execution Telemetry

·        Appliance process, service, command-execution, administrative, and system logs where available.

·        Process or service identity, parent and child relationship where available, command or action, user context, path, timestamp, hostname, and appliance identifier.

·        Windows process-creation and service telemetry for RRAS servers where available.

·        RemoteAccess service identity, active service-process attribution, parent process identifier, child process identity, executable path, user, and timestamp for RRAS execution correlation.

·        Command-line data where process-creation auditing, Sysmon, EDR, or equivalent telemetry provides it.

·        Events covering shell, script, utility, hotfix, route, service, configuration, archive, transfer, and credential-access activity.

·        Approved administrator, vendor support, maintenance, patching, backup, restoration, monitoring, and incident-response exceptions.

·        Appliance-level execution telemetry is highly valuable but may be unavailable on managed or closed security appliances.

Memory and Execution Telemetry

·        Appliance runtime, process, service, fault, or forensic telemetry where supported.

·        Evidence linking suspicious external requests to appliance-local service access or unauthorized execution.

·        For Windows RRAS systems, evidence linking suspicious external activity to execution from a process positively attributed to the RemoteAccess service.

·        Service creation, process execution, script execution, permission change, or temporary-file activity where visible.

·        Memory-level telemetry is optional enrichment and is not a minimum deployment requirement.

·        Web, appliance audit, configuration, network, and identity telemetry must provide compensating evidence where runtime visibility is unavailable.

Crash and Fault Telemetry

·        Gateway system logs.

·        Windows System and Application logs for RRAS servers where available.

·        Service logs.

·        Administrative logs.

·        Health and monitoring alerts.

·        Process or service restart records.

·        Appliance reboot records.

·        RRAS RemoteAccess service start, stop, failure, restart, or recovery records where available.

·        Unexpected service faults, connection failures, recovery events, or instability near suspicious requests.

·        Approved upgrades, hotfixes, maintenance, support activity, and incident-response actions must be available for tuning.

File and Persistence Telemetry

·        Configuration creation, modification, deletion, export, import, backup, and restoration records.

·        Hotfix, script, route, service, account, and access-control change records.

·        File creation, modification, permission change, execution, deletion, and temporary-file activity where exposed by the appliance.

·        Access to session databases, credential stores, TOTP seed material, authentication tokens, and directory-integration credentials where auditable.

·        Known-good configuration baselines and approved change records.

·        Configuration-difference or integrity monitoring where supported.

Network and Outbound Communication Telemetry

·        Firewall logs.

·        NDR metadata.

·        Network-flow records.

·        DNS logs.

·        Proxy logs where applicable.

·        Gateway web and connection logs.

·        Endpoint or host network-connection telemetry for RRAS servers where available.

·        Source and destination IP address, destination port, protocol, action, request path, response status, session identifier, timestamp, and appliance or host identity.

·        Mapping of gateway communication to domain controllers, identity providers, management services, and approved internal destinations.

·        Visibility into loopback, appliance-local, and internal proxy destinations where available.

·        Network telemetry should distinguish expected remote-access traffic from appliance-originated internal communication.

·        RRAS network telemetry should be time-correlatable with RemoteAccess service and process events where exploit-to-execution detection is required.

Web and Application Telemetry (Conditional Availability)

·        Remote-access gateway web, proxy, relay, WebSocket, API, administrative, and access logs.

·        HTTP method, URI path, query or host value, source IP, forwarded source IP, user agent, response status, protocol upgrade, destination host, destination port, timestamp, session, and appliance identifier where available.

·        Authentication, session creation, session termination, VPN connection, administrative access, and directory-integration records.

·        RRAS connection, VPN, and remote-access session records where available.

·        Logs showing requests to unintended, loopback, localhost, appliance-local, link-local, or unauthorized internal destinations.

·        Administrative and configuration events linked to the same gateway and time window.

·        Web telemetry should establish exploit-attempt and initial-access context but should not alone be treated as proof of successful appliance or RRAS compromise.

Telemetry Availability Requirements

·        Minimum viable coverage requires gateway web or connection logs, appliance identity, source and destination details, authentication records, VPN session records, and domain-controller or identity-service logs.

·        Strong coverage requires gateway audit and configuration telemetry joined to internal network activity, service-account use, workstation names, and VPN session context.

·        Strong RRAS exploit-to-execution coverage additionally requires confirmed RRAS host inventory, current RemoteAccess service-process attribution, and process-creation telemetry.

·        Highest confidence requires correlation across suspicious external interaction, appliance-local service access or validated RRAS service-context execution, unauthorized execution or configuration change, authentication-material access, and gateway-originated internal authentication.

·        Environments without appliance process or filesystem visibility require compensating evidence from web, configuration, network, identity, session, and directory-service telemetry.

·        RRAS environments without service-to-process attribution or process-creation telemetry should not claim direct RRAS service-host execution detection.

·        Retention must be sufficient to investigate activity that occurred before patching, rebuilding, credential rotation, TOTP reset, or RRAS service restart.

Telemetry Limitations and Gaps

·        Closed security appliances may not expose process, command-line, memory, or file telemetry.

·        Windows RRAS telemetry may identify svchost.exe without identifying the specific hosted service unless current service-to-process attribution is maintained.

·        RemoteAccess service process identifiers may change after service or host restart.

·        Process command-line data may be unavailable when the applicable Windows auditing or endpoint telemetry configuration does not collect it.

·        Memory-only exploitation may not produce observable child-process execution.

·        Gateway web logs may not record the final appliance-local destination or decoded request value.

·        Reverse proxies, NAT, or load balancers may obscure the original source address.

·        WebSocket or relay activity may be recorded without full request content.

·        Appliance-local loopback communication may not be visible to external network sensors.

·        Configuration changes may lack the originating user, process, or request context.

·        RRAS service faults or restarts may occur for benign operational reasons and are not proof of exploitation.

·        Authentication logs may not preserve a reliable link to the originating gateway session.

·        Workstation names can be missing, spoofed, reused, or inconsistently normalized.

·        NTLM, LDAP, Kerberos, and VPN telemetry may reside in separate systems with different timestamps and retention periods.

·        Legitimate directory integration and service-account activity may resemble portions of the identity-pivot sequence.

·        Patching may remove the vulnerable condition without determining whether compromise occurred earlier.

·        Appliance reboots, updates, service restarts, and configuration restoration may overwrite useful evidence.

·        Attackers may use valid sessions, existing service accounts, or stolen authentication material without generating exploit-specific indicators.

S24 — Detection Opportunities and Gaps

Detection Opportunities

·        Gateway web and connection logs can identify suspicious proxy, relay, or WebSocket activity directed toward loopback, appliance-local, or unauthorized internal services.

·        Response and connection records can distinguish failed probing from successful protocol upgrade or relay activity.

·        Appliance audit and configuration logs can identify unauthorized hotfix, route, service, account, or configuration changes.

·        Windows RRAS service and process telemetry can identify suspicious child execution from a process positively attributed to the RemoteAccess service.

·        External activity against an RRAS server can be correlated with RemoteAccess service faults, restarts, or suspicious process execution to strengthen exploit-to-execution confidence.

·        Gateway-held session, credential, token, and TOTP data access may provide evidence of authentication-material theft where auditing exists.

·        VPN session records can be compared with gateway-originated internal authentication to identify access without an authorized remote session.

·        Domain-controller and identity telemetry can identify gateway service-account use, unfamiliar workstation names, unusual authentication types, and unexpected destinations.

·        Firewall, NDR, and flow telemetry can identify abnormal gateway communication with internal identity, management, and high-value systems.

·        Correlation across gateway requests, appliance or RRAS execution activity, internal network activity, and authentication events can reveal the compromise sequence without relying on one exploit indicator.

·        Configuration baselines and approved change records can separate routine maintenance from unauthorized appliance modification.

·        The behavior model can support future remote-access gateway compromise activity without depending on one vendor CVE, RRAS CVE, or endpoint path.

Detection Gaps

·        Direct proof of appliance command execution may be unavailable when the platform does not expose process or shell telemetry.

·        RRAS execution may be visible only as generic svchost.exe activity unless RemoteAccess service-to-process attribution is maintained.

·        Memory-only RRAS exploitation may not produce observable child-process execution.

·        RRAS service faults, restarts, or recovery events may occur for benign reasons and are not unique to exploitation.

·        Loopback and appliance-local traffic may not be visible outside the gateway.

·        Gateway logs may omit decoded host values, destination services, request bodies, or WebSocket content.

·        Successful exploitation may occur without a distinctive crash, reboot, service failure, or observable child process.

·        Legitimate proxy, relay, health-check, support, RRAS administration, or directory-integration activity may resemble portions of the attack sequence.

·        Configuration and hotfix events may not identify the initiating external request or process.

·        Stolen sessions, credentials, tokens, or TOTP seeds may be used later from a different system or network.

·        Valid service-account use may not be distinguishable from abuse without workstation, session, destination, and behavioral context.

·        Identity and network telemetry may not retain sufficient history to reconstruct pre-patch compromise.

·        Patching alone cannot confirm whether authentication material, appliance trust, or RRAS host trust was previously exposed.

·        Attackers may clean logs, remove files, restore configuration, restart services, or reboot the appliance or RRAS server after compromise.

·        Downstream authentication and lateral movement are not unique to remote-access gateway exploitation.

Compensating Controls

·        Preserve gateway web, audit, configuration, authentication, session, health, firewall, NDR, flow, identity, and domain-controller telemetry before patching or rebuilding.

·        Preserve Windows service and process telemetry for RRAS servers where available.

·        Maintain or preserve RemoteAccess service-to-process attribution during RRAS investigations.

·        Export and compare the current gateway configuration with a known-good baseline.

·        Validate source-address, request-path, destination, session, service-account, workstation-name, service identity, parent-process, and timestamp fields before deploying detections.

·        Map each gateway to its approved directory accounts, domain controllers, identity providers, management systems, and internal destinations.

·        Baseline expected VPN session behavior, RemoteAccess service behavior, gateway-originated authentication, vendor support, hotfix, backup, restoration, and administrative activity.

·        Alert on gateway-originated internal authentication that lacks a corresponding authorized remote-access or administrative session.

·        Monitor gateway-integrated accounts for unfamiliar workstation names, systems, destinations, or access paths.

·        Restrict gateway communication to required internal services and approved destinations.

·        Rotate gateway administrator, service-account, user, token, and TOTP material when exposure cannot be ruled out.

·        Rebuild or redeploy the gateway or affected RRAS server when forensic confidence is insufficient to establish system integrity.

·        Treat patch status, KEV designation, public exploit information, RRAS service faults, and generic svchost.exe activity as prioritization inputs rather than proof of compromise.

Non-Coverage Conditions

·        Activity limited to vulnerable firmware or software, internet exposure, CVE status, or KEV status without suspicious gateway, RRAS service, process, configuration, network, authentication, or identity behavior.

·        Static indicators, exploit strings, source IP addresses, filenames, hashes, or process names without behavioral linkage.

·        Ordinary proxy, WebSocket, relay, VPN, RRAS, LDAP, directory-integration, health-check, or administrative activity that matches approved behavior.

·        Approved hotfix, route, configuration, backup, restoration, vendor support, vulnerability testing, service recovery, or incident-response activity.

·        Isolated gateway errors, RRAS service faults, service restarts, svchost.exe activity, appliance or host reboots, or configuration changes without suspicious surrounding activity.

·        Generic child-process activity from svchost.exe without validated RemoteAccess service attribution.

·        Generic authentication anomalies with no gateway, RRAS host, service-account, session, source, destination, service, process, or time-window linkage.

·        Internal identity compromise or lateral movement where no remote-access gateway behavior is present.

·        Exploitation of a remote-access gateway or RRAS service that produces no observable web, appliance, service, process, configuration, network, session, authentication, or downstream identity evidence.

Authorized vulnerability testing, penetration testing, incident response, forensic collection, or exploit validation performed within approved scope.

S25 — Ultra-Tuned Detection Engineering Rules

NDR / Network Behavioral Analytics

Detection Viability Assessment

NDR / Network Behavioral Analytics has three rules for this EXP report.

·        NDR is viable for detecting suspicious proxy activity involving appliance-local services, unexplained authentication originating from a remote-access gateway, and abnormal internal access following suspicious gateway activity.

·        NDR is strongest when gateway request logs, network-flow telemetry, firewall records, VPN session records, authentication telemetry, and gateway asset mapping are available.

·        NDR cannot independently confirm appliance-local command execution, configuration manipulation, session-database access, credential theft, or TOTP-seed theft.

·        NDR findings require corroboration from gateway, authentication, configuration, session, or incident-response evidence before activity is classified as confirmed compromise.

·        Vulnerable firmware, internet exposure, source-IP reputation, isolated WebSocket traffic, or gateway-originated authentication alone must not be treated as confirmed exploitation.

Rule

Suspicious Gateway Proxy Access to Appliance-Local Services

Rule Format

NDR behavioral HTTP and proxy rule

Detection Purpose

Detect remote-access gateway proxy, relay, or WebSocket requests directed toward loopback, localhost, link-local, appliance-local, or prohibited management destinations.

Detection Logic

Alert when an external request reaches a mapped remote-access gateway, uses a proxy, relay, or WebSocket function, references an appliance-local or prohibited destination, and shows evidence of successful connection establishment. Increase confidence when the request targets loopback or link-local addressing, a known appliance-local service, or a prohibited management interface.

Required Telemetry

·        Gateway HTTP, proxy, relay, WebSocket, WAF, or reverse-proxy telemetry.

·        Source IP, destination gateway, URI path, requested host or destination, requested port, response status, protocol-upgrade result, and timestamp.

·        Asset inventory identifying secure remote-access gateways.

·        Lookup data for loopback, link-local, appliance-local, and prohibited management destinations.

·        Approved testing, support, monitoring, and incident-response records.

Engineering Implementation Instructions

Normalize requested hostnames and IP addresses before comparison. Include IPv4, IPv6, alternate loopback representations, and encoded destination values where the platform exposes them. Do not suppress the behavior solely because the source appears on an approved list. Verify that the source, target, timing, and request pattern match an authorized activity record before lowering severity. Deploy in hunt mode until normal gateway proxy behavior has been confirmed.

DRI Assessment

This rule is resilient because it detects the operational proxy behavior rather than a CVE name, exploit string, source address, or fixed payload. Detection readiness depends on visibility into the requested destination and successful proxy or protocol-upgrade state.

DRI

8.8 / 10

TCR Assessment

Operational tuning confidence is strong when the gateway exposes request destinations and successful connection indicators. Authorized vulnerability testing, vendor support, and gateway troubleshooting may resemble portions of the behavior.

Operational TCR

8.3 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

Encrypted traffic may prevent an external sensor from observing the URI or requested destination. Appliance-local loopback traffic may not cross a network sensor. Some gateways may record a successful WebSocket upgrade without identifying the final connected service. This rule cannot prove subsequent command execution or authentication-material theft.

Detection Query Pattern

Use this pattern as an implementation guide and map the field names to the NDR or gateway telemetry available in the environment.

FROM gateway_http_or_proxy_events

EVAL normalized_requested_host =

  NORMALIZE_AND_DECODE_HOST(requested_host)

EVAL normalized_requested_destination =

  NORMALIZE_AND_DECODE_DESTINATION(requested_destination)

EVAL normalized_requested_ip =

  RESOLVE_AND_NORMALIZE_IP(

    normalized_requested_host,

    requested_ip

  )

WHERE destination_asset IN ENV_REMOTE_ACCESS_GATEWAYS

AND source_ip NOT IN ENV_INTERNAL_ADDRESS_RANGES

AND gateway_function IN (

  "proxy",

  "relay",

  "websocket_proxy"

)

AND (

  normalized_requested_ip IN ENV_LOOPBACK_ADDRESS_RANGES

  OR normalized_requested_ip IN ENV_LINK_LOCAL_ADDRESS_RANGES

  OR normalized_requested_host IN ENV_GATEWAY_LOCAL_HOSTNAMES

  OR normalized_requested_destination IN ENV_GATEWAY_LOCAL_SERVICES

  OR normalized_requested_destination IN ENV_PROHIBITED_GATEWAY_DESTINATIONS

)

AND (

  http_status = 101

  OR protocol_upgrade = "websocket"

  OR proxy_connection_result = "success"

  OR relay_session_created = true

)

RETURN

timestamp,

source_ip,

destination_asset,

uri_path,

normalized_requested_host,

normalized_requested_ip,

normalized_requested_destination,

requested_port,

http_status,

protocol_upgrade,

proxy_connection_result,

session_id

Rule

Gateway-Originated Authentication Without Expected Context

Rule Format

NDR authentication and session-correlation rule

Detection Purpose

Detect authentication originating from a secure remote-access gateway when the activity does not match an active remote-access session or the gateway’s approved directory-service behavior.

Detection Logic

Alert when a mapped remote-access gateway authenticates to a domain controller, LDAP service, identity system, or other internal authentication service and the activity lacks an associated VPN session or approved gateway service context. Increase confidence when the account, workstation name, destination, protocol, or timing differs from the established gateway baseline.

Required Telemetry

·        Firewall, NDR, or network-flow telemetry showing gateway communication with internal identity services.

·        Domain-controller, LDAP, Kerberos, NTLM, SMB, or identity-service authentication records.

·        VPN and remote-access session records.

·        Approved gateway service-account inventory.

·        Expected gateway workstation names, authentication destinations, protocols, and service windows.

·        Gateway asset and address mapping.

Engineering Implementation Instructions

Map each gateway to its approved directory accounts, identity destinations, authentication protocols, and normal service windows. Correlate authentication with active VPN sessions using available session identifiers, assigned addresses, users, gateway identity, and timestamp overlap. Do not require the remote user and gateway service account to be the same identity. Treat missing session telemetry as a limitation rather than automatic proof of malicious activity. Require an absent session or service context plus at least one meaningful baseline deviation before alerting.

DRI Assessment

This rule is durable because unexplained authentication originating from a trusted remote-access gateway remains suspicious across different exploit paths. Detection readiness depends on complete VPN session records, reliable gateway mapping, and accurate authentication context.

DRI

8.6 / 10

TCR Assessment

Operational tuning confidence is moderate to strong. Legitimate directory synchronization, health checks, service-account use, delayed log ingestion, or incomplete session records may create apparent mismatches.

Operational TCR

7.9 / 10

Full-Telemetry TCR

9.0 / 10

Limitations

Session records may be delayed, incomplete, or stored separately from authentication telemetry. Workstation names may be absent, inconsistent, or spoofed. Gateway service accounts may legitimately authenticate without an end-user VPN session. This rule cannot independently determine how the gateway or account was compromised.

Detection Query Pattern

Use this pattern as an implementation guide and perform the session comparison in the NDR platform, SIEM, or supporting correlation layer.

FROM internal_authentication_events AS auth

EVAL session_telemetry_available =

  VPN_SESSION_DATA_AVAILABLE = true

EVAL matching_active_remote_access_session =

  EXISTS vpn_or_remote_access_session AS session

  WHERE session.gateway_asset = auth.source_asset

  AND session.session_status IN (

    "active",

    "established",

    "authorized"

  )

  AND session.session_start_time <= auth.timestamp

  AND (

    session.session_end_time IS NULL

    OR session.session_end_time >= auth.timestamp

  )

  AND (

    session.session_id = auth.authentication_session_id

    OR session.assigned_internal_ip = auth.related_client_ip

  )

EVAL matching_approved_gateway_service_activity =

  auth.account IN ENV_APPROVED_GATEWAY_SERVICE_ACCOUNTS

  AND auth.destination_asset IN

    ENV_APPROVED_GATEWAY_IDENTITY_DESTINATIONS

  AND auth.authentication_protocol IN

    ENV_APPROVED_GATEWAY_AUTH_PROTOCOLS

  AND auth.timestamp IN ENV_APPROVED_GATEWAY_SERVICE_WINDOWS

  AND (

    auth.workstation_name IS NULL

    OR auth.workstation_name IN

      ENV_APPROVED_GATEWAY_WORKSTATION_NAMES

  )

WHERE auth.source_asset IN ENV_REMOTE_ACCESS_GATEWAYS

AND auth.destination_asset IN ENV_INTERNAL_IDENTITY_SERVICES

AND auth.authentication_protocol IN (

  "ldap",

  "ldaps",

  "kerberos",

  "ntlm",

  "smb"

)

AND auth.authentication_result = "success"

AND session_telemetry_available = true

AND matching_active_remote_access_session = false

AND matching_approved_gateway_service_activity = false

AND (

  auth.account NOT IN ENV_APPROVED_GATEWAY_SERVICE_ACCOUNTS

  OR (

    auth.workstation_name IS NOT NULL

    AND auth.workstation_name NOT IN

      ENV_APPROVED_GATEWAY_WORKSTATION_NAMES

  )

  OR auth.destination_asset NOT IN

    ENV_APPROVED_GATEWAY_IDENTITY_DESTINATIONS

  OR auth.authentication_protocol NOT IN

    ENV_APPROVED_GATEWAY_AUTH_PROTOCOLS

  OR auth.timestamp NOT IN

    ENV_APPROVED_GATEWAY_SERVICE_WINDOWS

)

RETURN

auth.timestamp,

auth.source_asset,

auth.source_ip,

auth.destination_asset,

auth.destination_ip,

auth.account,

auth.workstation_name,

auth.authentication_protocol,

auth.logon_type,

auth.session_id,

auth.related_client_ip

Rule

Suspicious Internal Access Following Gateway Exploitation Activity

Rule Format

NDR behavioral sequence rule

Detection Purpose

Detect abnormal internal communication from a secure remote-access gateway after suspicious proxy, relay, or appliance-local connection activity.

Detection Logic

Alert when a high-confidence suspicious gateway proxy event is followed by internal communication from the same gateway to new, unusual, unapproved, or administratively sensitive destinations. Increase severity when the gateway reaches identity systems, management platforms, backup infrastructure, virtualization systems, storage systems, jump hosts, or multiple internal destinations outside its normal remote-access role.

Required Telemetry

·        Gateway HTTP, proxy, relay, WebSocket, WAF, or reverse-proxy events.

·        NDR, firewall, or network-flow telemetry for gateway-originated internal communication.

·        Gateway-specific approved destination, port, and protocol baselines.

·        Internal asset-role and criticality enrichment.

·        Destination first-seen or rarity data where available.

·        Approved maintenance, monitoring, support, testing, and incident-response records.

Engineering Implementation Instructions

Use the suspicious appliance-local proxy behavior from the first NDR rule as the initiating event. Correlate subsequent internal activity from the same gateway within a defined time window. Evaluate unusual destinations, ports, protocols, failed connection patterns, and destination diversity. Treat access to a high-value system as severity enrichment, not as proof of abnormal activity by itself. Use gateway-specific baselines and begin in hunt mode.

DRI Assessment

This rule is resilient because it identifies the gateway moving beyond its expected broker role after suspicious external activity. Detection quality depends on reliable gateway attribution, internal network visibility, and gateway-specific communication baselines.

DRI

8.2 / 10

TCR Assessment

Operational tuning confidence is moderate because configuration changes, network redesign, disaster recovery, monitoring deployment, and troubleshooting may introduce legitimate new destinations or services.

Operational TCR

7.7 / 10

Full-Telemetry TCR

8.8 / 10

Limitations

A gateway may legitimately communicate with several internal systems. Network-flow telemetry may not identify the command, account, or action performed. Low-volume access to an already approved destination may evade the rule. This rule requires a preceding suspicious gateway event and should not classify isolated new connections as confirmed lateral movement.

Detection Query Pattern

Use this pattern as an implementation guide and correlate the two behavior stages by gateway identity and time.

STAGE 1

FROM gateway_http_or_proxy_events

EVAL normalized_requested_host =

  NORMALIZE_AND_DECODE_HOST(requested_host)

EVAL normalized_requested_destination =

  NORMALIZE_AND_DECODE_DESTINATION(requested_destination)

EVAL normalized_requested_ip =

  RESOLVE_AND_NORMALIZE_IP(

    normalized_requested_host,

    requested_ip

  )

WHERE destination_asset IN ENV_REMOTE_ACCESS_GATEWAYS

AND source_ip NOT IN ENV_INTERNAL_ADDRESS_RANGES

AND gateway_function IN (

  "proxy",

  "relay",

  "websocket_proxy"

)

AND (

  normalized_requested_ip IN ENV_LOOPBACK_ADDRESS_RANGES

  OR normalized_requested_ip IN ENV_LINK_LOCAL_ADDRESS_RANGES

  OR normalized_requested_host IN ENV_GATEWAY_LOCAL_HOSTNAMES

  OR normalized_requested_destination IN ENV_GATEWAY_LOCAL_SERVICES

  OR normalized_requested_destination IN ENV_PROHIBITED_GATEWAY_DESTINATIONS

)

AND (

  http_status = 101

  OR protocol_upgrade = "websocket"

  OR proxy_connection_result = "success"

  OR relay_session_created = true

)

STAGE 2

FROM network_flow_events

EVAL approved_destinations =

  LOOKUP(

    ENV_GATEWAY_APPROVED_DESTINATIONS_BY_ASSET,

    STAGE_1.destination_asset

  )

EVAL approved_ports =

  LOOKUP(

    ENV_GATEWAY_APPROVED_PORTS_BY_ASSET,

    STAGE_1.destination_asset

  )

EVAL approved_protocols =

  LOOKUP(

    ENV_GATEWAY_APPROVED_PROTOCOLS_BY_ASSET,

    STAGE_1.destination_asset

  )

EVAL destination_count_baseline =

  LOOKUP(

    ENV_GATEWAY_DESTINATION_COUNT_BASELINE_BY_ASSET,

    STAGE_1.destination_asset

  )

EVAL failed_connection_ratio_baseline =

  LOOKUP(

    ENV_GATEWAY_FAILED_CONNECTION_RATIO_BASELINE_BY_ASSET,

    STAGE_1.destination_asset

  )

EVAL destination_key =

  COALESCE(

    destination_asset,

    destination_ip

  )

EVAL internal_destination_count =

  DISTINCT_COUNT(destination_key)

  BY source_asset

  WITHIN ENV_GATEWAY_COMPROMISE_TO_INTERNAL_EXPANSION_WINDOW

EVAL failed_connection_ratio =

  COUNT_IF(connection_result = "failed")

  /

  MAX(COUNT(), 1)

  BY source_asset

  WITHIN ENV_GATEWAY_COMPROMISE_TO_INTERNAL_EXPANSION_WINDOW

EVAL destination_is_high_value =

  destination_role IN ENV_HIGH_VALUE_INTERNAL_ROLES

WHERE source_asset = STAGE_1.destination_asset

AND destination_ip IN ENV_INTERNAL_ADDRESS_RANGES

AND timestamp >= STAGE_1.timestamp

AND timestamp <=

  STAGE_1.timestamp +

  ENV_GATEWAY_COMPROMISE_TO_INTERNAL_EXPANSION_WINDOW

AND (

  destination_key NOT IN approved_destinations

  OR destination_port NOT IN approved_ports

  OR protocol NOT IN approved_protocols

  OR destination_first_seen_status IN (

    "new",

    "rare"

  )

  OR internal_destination_count >

    destination_count_baseline

  OR failed_connection_ratio >

    failed_connection_ratio_baseline

)

EVAL severity =

  CASE

    WHEN destination_is_high_value = true

      THEN "critical"

    ELSE "high"

  END

RETURN

STAGE_1.timestamp,

STAGE_1.source_ip,

STAGE_1.destination_asset,

STAGE_1.normalized_requested_destination,

timestamp,

destination_asset,

destination_ip,

destination_key,

destination_port,

protocol,

destination_role,

destination_is_high_value,

destination_first_seen_status,

internal_destination_count,

failed_connection_ratio,

severity

SentinelOne

Detection Viability Assessment

SentinelOne has one rule for this EXP report.

·        SentinelOne is viable for detecting suspicious endpoint activity that follows network access originating from a compromised remote-access gateway.

·        SentinelOne is strongest when Deep Visibility telemetry is available in Singularity Data Lake and preserves network connections, process ancestry, command lines, user context, endpoint identity, and source-address information.

·        SentinelOne generally cannot observe proxy exploitation, appliance-local command execution, gateway configuration manipulation, session-database access, credential theft, or TOTP-seed theft occurring inside a closed remote-access appliance.

·        The rule therefore detects downstream execution and post-exploitation behavior on SentinelOne-protected endpoints rather than the initial gateway exploit.

·        Gateway-originated network access alone must not be treated as endpoint compromise without suspicious process or user activity on the destination system.

Rule

Suspicious Endpoint Execution Following Remote-Access Gateway Connection

Rule Format

SentinelOne Singularity Data Lake PowerQuery behavioral correlation rule

Detection Purpose

Detect suspicious shell, script, administrative utility, credential-access, or discovery execution on a protected endpoint shortly after the endpoint receives network access from a mapped secure remote-access gateway.

Detection Logic

Alert when a SentinelOne-protected endpoint receives a connection from a secure remote-access gateway and subsequently launches an unexpected shell, scripting engine, remote-management utility, credential-access tool, discovery command, or other suspicious process within a defined time window. Increase confidence when the process runs under an unusual account, has abnormal parentage, uses encoded or obfuscated arguments, or accesses credential material.

Required Telemetry

·        SentinelOne Deep Visibility network-connection telemetry available in Singularity Data Lake.

·        Process creation, process ancestry, command line, user, endpoint, file path, hash, and timestamp data.

·        Source and destination IP addresses and ports.

·        Asset inventory identifying secure remote-access gateway addresses.

·        Approved administrative tools, remote-management processes, service accounts, jump hosts, maintenance windows, and incident-response activity.

·        Endpoint role and criticality enrichment where available.

Engineering Implementation Instructions

Map all secure remote-access gateway addresses, clustered nodes, virtual appliances, translated addresses, and internal interfaces before deployment. Use PowerQuery to join gateway-originated network events with subsequent process-creation events on the same SentinelOne agent. Apply a short operational correlation window and baseline approved remote administration, help-desk access, vulnerability scanning, software deployment, monitoring, and incident-response activity. Require suspicious execution or process context in addition to the gateway connection. Deploy in hunt mode before alert promotion.

DRI Assessment

This rule is resilient because it detects downstream endpoint behavior rather than relying on a specific SonicWall vulnerability, exploit string, source infrastructure, or payload. Detection readiness depends on accurate gateway attribution, network-to-process correlation, and complete endpoint telemetry.

DRI

8.4 / 10

TCR Assessment

Operational tuning confidence is moderate to strong. Approved remote administration, software deployment, troubleshooting, vulnerability scanning, and incident-response activity may produce similar connection and process sequences.

Operational TCR

8.0 / 10

Full-Telemetry TCR

8.9 / 10

Limitations

SentinelOne may not be installed on the remote-access gateway and therefore cannot directly observe appliance-local exploitation or trust-material theft. Network telemetry may identify the gateway as the source without preserving the original remote user or external address. Legitimate remote administration may launch shells, scripts, or management utilities. PowerQuery availability and scheduled-detection support depend on the deployed SentinelOne licensing and platform configuration. This rule cannot independently prove that the gateway itself was compromised.

Detection Query Pattern

Use this native SentinelOne Singularity Data Lake PowerQuery pattern as an implementation guide. Replace the gateway addresses, correlation window, approved processes, approved accounts, command patterns, paths, hashes, and approval-context field with local environment data.

| join

    network = (

      EventType = "IP Connect"

      AND SrcIP In (

        "ENV_REMOTE_ACCESS_GATEWAY_IP_1",

        "ENV_REMOTE_ACCESS_GATEWAY_IP_2"

      )

      AND AgentName Is Not Empty

      AND DstIP Is Not Empty

      | columns

          AgentName,

          network_time = timestamp,

          gateway_source_ip = SrcIP,

          endpoint_destination_ip = DstIP,

          gateway_destination_port = DstPort

    ),

    process = (

      EventType = "Process Creation"

      AND (

        ProcessName In (

          "cmd.exe",

          "powershell.exe",

          "pwsh.exe",

          "wscript.exe",

          "cscript.exe",

          "mshta.exe",

          "rundll32.exe",

          "regsvr32.exe",

          "wmic.exe",

          "certutil.exe",

          "whoami.exe",

          "net.exe",

          "nltest.exe",

          "dsquery.exe",

          "ssh.exe",

          "bash",

          "sh",

          "python",

          "python3"

        )

        OR ProcessCmd RegExp "ENV_SUSPICIOUS_COMMAND_REGEX"

        OR ProcessImagePath RegExp

          "ENV_USER_WRITABLE_OR_TEMPORARY_PATH_REGEX"

        OR ProcessImageSha1Hash In (

          "ENV_KNOWN_MALICIOUS_SHA1_1",

          "ENV_KNOWN_MALICIOUS_SHA1_2"

        )

      )

      AND NOT (

        ProcessName In (

          "ENV_APPROVED_REMOTE_ADMIN_PROCESS_1",

          "ENV_APPROVED_REMOTE_ADMIN_PROCESS_2"

        )

        AND User In (

          "ENV_APPROVED_REMOTE_ADMIN_ACCOUNT_1",

          "ENV_APPROVED_REMOTE_ADMIN_ACCOUNT_2"

        )

        AND ApprovedRemoteAdminWindow = true

      )

      | columns

          AgentName,

          process_time = timestamp,

          User,

          ParentProcessName,

          ProcessName,

          ProcessCmd,

          ProcessImagePath,

          ProcessImageSha1Hash,

          ProcessStartTime,

          ProcessUniqueKey,

          ProcessGroupId

    )

  on

    AgentName

| let correlation_seconds =

    (process.process_time - network.network_time) / 1000000000

| filter

    correlation_seconds >= 0

    AND correlation_seconds <=

      ENV_GATEWAY_CONNECTION_TO_PROCESS_WINDOW_SECONDS

| columns

network.network_time,

    network.gateway_source_ip,

    network.endpoint_destination_ip,

    network.gateway_destination_port,

    process.process_time,

    AgentName,

    process.User,

    process.ParentProcessName,

    process.ProcessName,

    process.ProcessCmd,

    process.ProcessImagePath,

    process.ProcessImageSha1Hash,

    process.ProcessStartTime,

    process.ProcessUniqueKey,

    process.ProcessGroupId,

    correlation_seconds

Splunk

Detection Viability Assessment

Splunk has three rules for this EXP report.

·        Splunk is viable for correlating remote-access gateway web activity, appliance administrative events, VPN session records, network telemetry, and identity authentication data.

·        Splunk is strongest when gateway logs, firewall or NDR records, VPN session telemetry, domain-controller events, asset inventories, and approved administrative baselines are normalized and time-aligned.

·        Splunk can detect suspicious gateway proxy behavior, unauthorized gateway configuration or hotfix activity, and gateway-originated authentication without expected remote-access context.

·        Splunk cannot independently prove appliance-local command execution, credential theft, session-database access, or TOTP-seed theft when the appliance does not expose those events.

·        Vulnerable firmware, internet exposure, isolated WebSocket activity, configuration changes, or gateway-originated authentication alone must not be treated as confirmed compromise.

Rule

Suspicious Gateway Proxy Access to Appliance-Local Services

Rule Format

Splunk SPL behavioral gateway-web rule

Detection Purpose

Detect remote-access gateway proxy, relay, or WebSocket requests directed toward loopback, link-local, appliance-local, or prohibited management destinations.

Detection Logic

Alert when an external request reaches a mapped remote-access gateway, invokes a proxy, relay, or WebSocket function, references an appliance-local or prohibited destination, and shows evidence of successful connection establishment. Increase confidence when the request targets loopback or link-local addressing, a known appliance-local service, or a prohibited management interface.

Required Telemetry

·        Gateway HTTP, proxy, relay, WebSocket, WAF, or reverse-proxy logs.

·        Source IP, destination gateway, URI path, requested host or destination, requested port, response status, protocol-upgrade result, and timestamp.

·        Asset inventory identifying secure remote-access gateways.

·        Lookups for loopback, link-local, appliance-local, and prohibited gateway destinations.

·        Approved testing, support, monitoring, and incident-response records.

Engineering Implementation Instructions

Normalize requested hostnames and IP addresses before comparison. Map vendor-specific gateway fields to consistent Splunk field names. Include IPv4, IPv6, alternate loopback representations, and encoded destinations where available. Do not suppress activity solely because the source appears in an approved lookup. Confirm that the source, target, timing, and request pattern match an authorized activity record before reducing severity. Deploy in hunt mode before alert promotion.

DRI Assessment

This rule is resilient because it detects the proxy behavior rather than a CVE name, exploit string, source address, or fixed payload. Detection readiness depends on visibility into the requested destination and successful connection state.

DRI

8.9 / 10

TCR Assessment

Operational tuning confidence is strong when gateway request logs preserve destination and response details. Authorized testing, vendor support, monitoring, and troubleshooting may resemble portions of the behavior.

Operational TCR

8.4 / 10

Full-Telemetry TCR

9.2 / 10

Limitations

Encrypted traffic may prevent external sensors from observing the URI or requested destination. Gateway logs may record a successful protocol upgrade without preserving the connected service. Appliance-local loopback traffic may not appear in network telemetry. This rule cannot prove subsequent command execution or authentication-material theft.

Detection Query Pattern

Use this pattern as an implementation guide and map index, sourcetype, field, macro, and lookup names to the environment.

index=env_gateway

sourcetype IN (

  "gateway:http",

  "gateway:proxy",

  "gateway:websocket",

  "waf:http"

)

| lookup env_remote_access_gateways

    gateway_ip AS dest_ip

    OUTPUT gateway_name

| where isnotnull(gateway_name)

| where NOT `env_internal_address_ranges(src_ip)`

| eval normalized_requested_host=lower(

    coalesce(requested_host, host_parameter)

  )

| eval normalized_requested_destination=lower(

    coalesce(requested_destination, proxy_destination)

  )

| eval normalized_requested_ip=coalesce(

    requested_ip,

    resolved_requested_ip

  )

| lookup env_gateway_local_services

    destination AS normalized_requested_destination

    OUTPUT destination AS local_service_match

| lookup env_prohibited_gateway_destinations

    destination AS normalized_requested_destination

    OUTPUT destination AS prohibited_destination_match

| where cidrmatch("127.0.0.0/8", normalized_requested_ip)

    OR normalized_requested_ip="::1"

    OR cidrmatch("169.254.0.0/16", normalized_requested_ip)

    OR normalized_requested_host IN (

      "localhost",

      "ip6-localhost"

    )

    OR isnotnull(local_service_match)

    OR isnotnull(prohibited_destination_match)

| where gateway_function IN (

    "proxy",

    "relay",

    "websocket_proxy"

  )

| where http_status=101

    OR protocol_upgrade="websocket"

    OR proxy_connection_result="success"

    OR relay_session_created=true

| table

    _time,

    src_ip,

    dest_ip,

    gateway_name,

    uri_path,

    normalized_requested_host,

    normalized_requested_ip,

    normalized_requested_destination,

    requested_port,

    http_status,

    protocol_upgrade,

    proxy_connection_result,

    session_id

Rule

Unauthorized Gateway Configuration or Hotfix Activity

Rule Format

Splunk SPL appliance-administration rule

Detection Purpose

Detect unexpected hotfix-removal, configuration, route, service, script, or filesystem activity on a secure remote-access gateway outside approved administrative workflows.

Detection Logic

Alert when a mapped remote-access gateway records a hotfix-removal action, configuration change, route modification, service change, script execution, or suspicious path-related event that does not match an approved administrator, maintenance window, vendor-support action, or change record. Increase confidence when traversal patterns, temporary scripts, unusual paths, unauthorized configuration objects, or repeated administrative changes are present.

Required Telemetry

·        Gateway administrative, audit, hotfix, configuration, route, service, and system logs.

·        Administrator, action, object, path, command, result, appliance, and timestamp fields.

·        Approved administrator accounts, support identities, maintenance windows, hotfix activity, and change records.

·        Known-good gateway configuration and route baselines.

·        Asset inventory identifying secure remote-access gateways.

Engineering Implementation Instructions

Normalize administrative actions and object names across gateway log sources. Map approved administrators, vendor-support identities, maintenance windows, hotfix identifiers, and change records before enabling alert mode. Treat traversal strings, temporary scripts, unexpected route changes, and unauthorized service or configuration modifications as high-value indicators. Require analyst review where gateway logs do not preserve the initiating process or request.

DRI Assessment

This rule is durable because it detects unauthorized appliance modification rather than one exploit path. Detection readiness depends on administrative and configuration-event visibility from the gateway.

DRI

8.7 / 10

TCR Assessment

Operational tuning confidence is strong when approved change and maintenance records are available. Legitimate hotfix removal, configuration restoration, troubleshooting, and vendor-support activity may produce similar events.

Operational TCR

8.2 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

Some gateways may not expose detailed command, process, or filesystem telemetry. Approved maintenance records may be incomplete or delayed. Attackers may modify the appliance without generating a distinct administrative event. This rule cannot independently determine whether the change resulted from external exploitation.

Detection Query Pattern

Use this pattern as an implementation guide and map administrative actions, paths, objects, and approval lookups to the gateway telemetry available in Splunk.

index=env_gateway

sourcetype IN (

  "gateway:audit",

  "gateway:admin",

  "gateway:system",

  "gateway:configuration"

)

| lookup env_remote_access_gateways

    gateway_ip AS dest_ip

    OUTPUT gateway_name

| where isnotnull(gateway_name)

| eval normalized_action=lower(

    coalesce(action, event_action, operation)

  )

| eval normalized_path=lower(

    coalesce(file_path, object_path, target_path)

  )

| eval normalized_object=lower(

    coalesce(object_name, configuration_object, service_name)

  )

| lookup env_prohibited_gateway_objects

    object_name AS normalized_object

    OUTPUT object_name AS prohibited_object_match

| eval suspicious_change=if(

    normalized_action IN (

      "remove_hotfix",

      "delete_hotfix",

      "modify_configuration",

      "add_route",

      "modify_route",

      "create_service",

      "modify_service",

      "execute_script"

    )

    OR match(normalized_path, "\.\./")

    OR match(normalized_path, "/tmp/|/var/tmp/")

    OR isnotnull(prohibited_object_match),

    1,

    0

  )

| lookup env_approved_gateway_changes

    gateway_name,

    user,

    normalized_action,

    normalized_object,

    normalized_path

    OUTPUT

      approval_start,

      approval_end,

      change_status

| eval approved_change=if(

    change_status="approved"

    AND time>=approvalstart

    AND time<=approvalend,

    1,

    0

  )

| where suspicious_change=1

    AND approved_change!=1

| table

    _time,

    gateway_name,

    user,

    src_ip,

    normalized_action,

    normalized_object,

    normalized_path,

    command,

    result

Rule

Gateway-Originated Authentication Without Expected Context

Rule Format

Splunk SPL identity and VPN-session correlation rule

Detection Purpose

Detect successful authentication originating from a secure remote-access gateway when no active remote-access session or approved gateway service context can be identified.

Detection Logic

Alert when a mapped gateway authenticates to an internal identity service, the activity does not match an active VPN session or approved directory-service workflow, and at least one meaningful baseline deviation is present. Increase confidence when the account, workstation name, destination, protocol, or timing differs from the established gateway baseline.

Required Telemetry

·        Domain-controller, LDAP, Kerberos, NTLM, SMB, or identity-service authentication logs.

·        VPN and remote-access session records.

·        Gateway asset and address mapping.

·        Approved gateway service accounts, workstation names, identity destinations, authentication protocols, and service windows.

·        Source IP, destination IP, account, workstation name, authentication protocol, logon type, session identifier, and timestamp.

Engineering Implementation Instructions

Map each gateway to its approved directory accounts, destinations, protocols, and service windows. Correlate authentication with active VPN sessions using session identifiers, assigned client addresses, gateway identity, and timestamp overlap. Do not require the remote-access user and gateway service account to be the same identity. Treat missing VPN session telemetry as a limitation rather than proof of malicious activity. Require absent expected context plus at least one baseline deviation before alerting.

DRI Assessment

This rule is durable because unexplained authentication originating from a trusted gateway remains suspicious across multiple exploit paths. Detection readiness depends on complete session telemetry, accurate gateway mapping, and reliable identity fields.

DRI

8.8 / 10

TCR Assessment

Operational tuning confidence is moderate to strong. Legitimate directory synchronization, health checks, service-account use, delayed ingestion, and incomplete VPN session records may create apparent mismatches.

Operational TCR

8.1 / 10

Full-Telemetry TCR

9.2 / 10

Limitations

VPN session logs may be incomplete, delayed, or stored separately from authentication telemetry. Workstation names may be absent, inconsistent, or spoofed. Gateway service accounts may legitimately authenticate without an end-user session. This rule cannot independently determine how the gateway or account was compromised.

Detection Query Pattern

Use this pattern as an implementation guide and map index, sourcetype, field, macro, and lookup names to the environment.

index=env_identity

sourcetype IN (

  "WinEventLog:Security",

  "ldap:auth",

  "kerberos:auth",

  "identity:authentication"

)

authentication_result="success"

| lookup env_remote_access_gateways

    gateway_ip AS src_ip

    OUTPUT gateway_name

| where isnotnull(gateway_name)

| lookup env_internal_identity_services

    identity_ip AS dest_ip

    OUTPUT identity_service

| where isnotnull(identity_service)

| eval normalized_account=lower(account)

| eval normalized_workstation=lower(workstation_name)

| lookup env_approved_gateway_service_context

    gateway_name,

    normalized_account,

    identity_service,

    authentication_protocol

    OUTPUT approved_service_context

| lookup env_approved_gateway_service_accounts

    account AS normalized_account

    OUTPUT account AS approved_account_match

| lookup env_approved_gateway_workstation_names

    workstation AS normalized_workstation

    OUTPUT workstation AS approved_workstation_match

| lookup env_approved_gateway_identity_destinations

    identity_service

    OUTPUT identity_service AS approved_destination_match

| lookup env_approved_gateway_auth_protocols

    protocol AS authentication_protocol

    OUTPUT protocol AS approved_protocol_match

| join type=left gateway_name session_id

    [

      search index=env_vpn

      sourcetype="gateway:vpn_session"

      session_status IN (

        "active",

        "established",

        "authorized"

      )

      | lookup env_remote_access_gateways

          gateway_ip

          OUTPUT gateway_name

      | eval vpn_telemetry_available=1

      | fields

          gateway_name,

          session_id,

          assigned_internal_ip,

          session_start,

          session_end,

          vpn_telemetry_available

    ]

| eval matching_session=if(

    vpn_telemetry_available=1

    AND isnotnull(session_id)

    AND time>=sessionstart

    AND (

      isnull(session_end)

      OR time<=sessionend

    ),

    1,

    0

  )

| eval baseline_deviation=if(

    isnull(approved_account_match)

    OR (

      isnotnull(normalized_workstation)

      AND isnull(approved_workstation_match)

    )

    OR isnull(approved_destination_match)

    OR isnull(approved_protocol_match),

    1,

    0

  )

| where vpn_telemetry_available=1

    AND matching_session=0

    AND isnull(approved_service_context)

    AND baseline_deviation=1

| table

    _time,

    gateway_name,

    src_ip,

    dest_ip,

    identity_service,

    normalized_account,

    normalized_workstation,

    authentication_protocol,

    logon_type,

    session_id

Elastic

Detection Viability Assessment

Elastic has three rules for this EXP report.

·        Elastic is viable for correlating remote-access gateway web activity, appliance administrative events, VPN session records, network telemetry, and identity authentication data.

·        Elastic is strongest when Elastic Agent, syslog ingestion, network telemetry, gateway audit logs, VPN records, and identity events are normalized to Elastic Common Schema.

·        Elastic can detect suspicious gateway proxy behavior, unauthorized gateway configuration or hotfix activity, and gateway-originated authentication without expected remote-access context.

·        Elastic cannot independently prove appliance-local command execution, credential theft, session-database access, or TOTP-seed theft when the gateway does not expose those events.

·        Vulnerable firmware, internet exposure, isolated WebSocket activity, configuration changes, or gateway-originated authentication alone must not be treated as confirmed compromise.

Rule

Suspicious Gateway Proxy Access to Appliance-Local Services

Rule Format

Elastic KQL behavioral gateway-web rule

Detection Purpose

Detect remote-access gateway proxy, relay, or WebSocket requests directed toward loopback, link-local, appliance-local, or prohibited management destinations.

Detection Logic

Alert when an external request reaches a mapped remote-access gateway, invokes a proxy, relay, or WebSocket function, references an appliance-local or prohibited destination, and shows evidence of successful connection establishment. Increase confidence when the request targets loopback or link-local addressing, a known appliance-local service, or a prohibited management interface.

Required Telemetry

·        Gateway HTTP, proxy, relay, WebSocket, WAF, or reverse-proxy logs.

·        Source IP, destination gateway, URI path, requested host or destination, requested port, response status, protocol-upgrade result, and timestamp.

·        Asset inventory identifying secure remote-access gateways.

·        Enrichment data for loopback, link-local, appliance-local, and prohibited gateway destinations.

·        Approved testing, support, monitoring, and incident-response records.

Engineering Implementation Instructions

Normalize vendor-specific fields to Elastic Common Schema or consistent custom fields. Enrich remote-access gateway assets and prohibited destinations during ingestion or through the detection rule. Include IPv4, IPv6, alternate loopback representations, and encoded destination values where available. Do not suppress activity solely because the source appears on an approved list. Deploy in hunt mode before alert promotion.

DRI Assessment

This rule is resilient because it detects proxy behavior rather than a CVE name, exploit string, source address, or fixed payload. Detection readiness depends on visibility into the requested destination and successful connection state.

DRI

8.8 / 10

TCR Assessment

Operational tuning confidence is strong when gateway request logs preserve destination and response details. Authorized testing, vendor support, monitoring, and troubleshooting may resemble portions of the behavior.

Operational TCR

8.3 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

Encrypted traffic may prevent external sensors from observing the URI or requested destination. Gateway logs may record a successful protocol upgrade without preserving the connected service. Appliance-local loopback traffic may not appear in network telemetry. This rule cannot prove subsequent command execution or authentication-material theft.

Detection Query Pattern

Use this pattern as an implementation guide and map index, field, and enrichment names to the Elastic data available in the environment.

event.dataset:(

  "gateway.http" OR

  "gateway.proxy" OR

  "gateway.websocket" OR

  "waf.http"

)

AND destination.ip:ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES

AND NOT source.ip:ENV_INTERNAL_ADDRESS_RANGES

AND gateway.function:(

  "proxy" OR

  "relay" OR

  "websocket_proxy"

)

AND (

  gateway.requested_ip:(

    "127.0.0.0/8" OR

    "::1" OR

    "169.254.0.0/16"

  )

  OR gateway.requested_host:(

    "localhost" OR

    "ip6-localhost"

  )

  OR gateway.requested_destination:ENV_GATEWAY_LOCAL_SERVICES

  OR gateway.requested_destination:ENV_PROHIBITED_GATEWAY_DESTINATIONS

)

AND (

  http.response.status_code:101

  OR network.protocol:"websocket"

  OR gateway.proxy_result:"success"

  OR gateway.relay_session_created:true

)

Rule

Unauthorized Gateway Configuration or Hotfix Activity

Rule Format

Elastic KQL appliance-administration rule

Detection Purpose

Detect unexpected hotfix-removal, configuration, route, service, script, or filesystem activity on a secure remote-access gateway outside approved administrative workflows.

Detection Logic

Alert when a mapped remote-access gateway records a hotfix-removal action, configuration change, route modification, service change, script execution, or suspicious path-related event that does not match an approved administrator, maintenance window, vendor-support action, or change record. Increase confidence when traversal patterns, temporary scripts, unusual paths, unauthorized configuration objects, or repeated administrative changes are present.

Required Telemetry

·        Gateway administrative, audit, hotfix, configuration, route, service, and system logs.

·        Administrator, action, object, path, command, result, appliance, and timestamp fields.

·        Approved administrator accounts, support identities, maintenance windows, hotfix activity, and change records.

·        Known-good gateway configuration and route baselines.

·        Asset inventory identifying secure remote-access gateways.

Engineering Implementation Instructions

Normalize gateway administrative events to consistent Elastic fields. Enrich gateway assets, prohibited configuration objects, approved administrators, maintenance windows, and active change records. Treat traversal strings, temporary scripts, unexpected route changes, and unauthorized service or configuration modifications as high-value indicators. Require analyst review where the gateway does not preserve the initiating process or request.

DRI Assessment

This rule is durable because it detects unauthorized appliance modification rather than one exploit path. Detection readiness depends on administrative and configuration-event visibility from the gateway.

DRI

8.7 / 10

TCR Assessment

Operational tuning confidence is strong when approved change and maintenance records are available. Legitimate hotfix removal, configuration restoration, troubleshooting, and vendor-support activity may produce similar events.

Operational TCR

8.2 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

Some gateways may not expose detailed command, process, or filesystem telemetry. Approved maintenance records may be incomplete or delayed. Attackers may modify the appliance without generating a distinct administrative event. This rule cannot independently determine whether the change resulted from external exploitation.

Detection Query Pattern

Use this pattern as an implementation guide and map event actions, paths, objects, and approval fields to the Elastic data available in the environment.

event.dataset:(

  "gateway.audit" OR

  "gateway.admin" OR

  "gateway.system" OR

  "gateway.configuration"

)

AND destination.ip:ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES

AND (

  event.action:(

    "remove_hotfix" OR

    "delete_hotfix" OR

    "modify_configuration" OR

    "add_route" OR

    "modify_route" OR

    "create_service" OR

    "modify_service" OR

    "execute_script"

  )

  OR file.path:(

    "*../*" OR

    "/tmp/*" OR

    "/var/tmp/*"

  )

  OR gateway.configuration_object:

    ENV_PROHIBITED_GATEWAY_OBJECTS

)

AND NOT gateway.change_approval_status:"approved"

Rule

Gateway-Originated Authentication Without Expected Context

Rule Format

Elastic EQL identity and VPN-session correlation rule

Detection Purpose

Detect successful authentication originating from a secure remote-access gateway when no active remote-access session or approved gateway service context can be identified.

Detection Logic

Alert when a mapped gateway authenticates to an internal identity service, the activity does not match an active VPN session or approved directory-service workflow, and at least one meaningful baseline deviation is present. Increase confidence when the account, workstation name, destination, protocol, or timing differs from the established gateway baseline.

Required Telemetry

·        Domain-controller, LDAP, Kerberos, NTLM, SMB, or identity-service authentication logs.

·        VPN and remote-access session records.

·        Gateway asset and address mapping.

·        Approved gateway service accounts, workstation names, identity destinations, authentication protocols, and service windows.

·        Source IP, destination IP, account, workstation name, authentication protocol, logon type, session identifier, and timestamp.

Engineering Implementation Instructions

Normalize authentication and VPN session events before correlation. Map each gateway to its approved directory accounts, identity destinations, protocols, and service windows. Correlate authentication with active VPN sessions using gateway identity, session identifiers, assigned client addresses, and timestamp overlap. Treat missing VPN session telemetry as a limitation rather than proof of malicious activity. Require absent expected context plus at least one baseline deviation before alerting.

DRI Assessment

This rule is durable because unexplained authentication originating from a trusted gateway remains suspicious across multiple exploit paths. Detection readiness depends on complete session telemetry, accurate gateway mapping, and reliable identity fields.

DRI

8.8 / 10

TCR Assessment

Operational tuning confidence is moderate to strong. Legitimate directory synchronization, health checks, service-account use, delayed ingestion, and incomplete VPN session records may create apparent mismatches.

Operational TCR

8.0 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

VPN session logs may be incomplete, delayed, or stored separately from authentication telemetry. Workstation names may be absent, inconsistent, or spoofed. Gateway service accounts may legitimately authenticate without an end-user session. This rule cannot independently determine how the gateway or account was compromised.

Detection Query Pattern

Use this pattern as an implementation guide and map category, field, and enrichment names to the Elastic data available in the environment.

sequence by source.ip, gateway.session_id with maxspan=15m

  [authentication where

    event.outcome == "success" and

    source.ip in ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES and

    destination.ip in ENV_INTERNAL_IDENTITY_SERVICES and

    network.protocol in (

      "ldap",

      "ldaps",

      "kerberos",

      "ntlm",

      "smb"

    ) and

    gateway.vpn_telemetry_available == true and

    gateway.approved_service_context != true and

    (

user.name not in ENV_APPROVED_GATEWAY_SERVICE_ACCOUNTS or

host.name not in ENV_APPROVED_GATEWAY_WORKSTATION_NAMES or

      destination.ip not in

        ENV_APPROVED_GATEWAY_IDENTITY_DESTINATIONS or

      network.protocol not in

        ENV_APPROVED_GATEWAY_AUTH_PROTOCOLS or

      gateway.approved_service_window != true

    )

  ]

  ![network where

    event.dataset == "gateway.vpn_session" and

    gateway.session_status in (

      "active",

      "established",

      "authorized"

    )

  ]

QRadar

Detection Viability Assessment

QRadar has three rules for this EXP report.

·        QRadar is viable for correlating remote-access gateway web activity, appliance administrative events, VPN session records, network flows, and identity authentication data.

·        QRadar is strongest when gateway logs, flow records, VPN telemetry, domain-controller events, asset inventories, and approved administrative baselines are normalized into consistent QRadar properties.

·        QRadar can detect suspicious gateway proxy behavior, unauthorized gateway configuration or hotfix activity, and gateway-originated authentication without expected remote-access context.

·        QRadar cannot independently prove appliance-local command execution, credential theft, session-database access, or TOTP-seed theft when the gateway does not expose those events.

·        Vulnerable firmware, internet exposure, isolated WebSocket activity, configuration changes, or gateway-originated authentication alone must not be treated as confirmed compromise.

Rule

Suspicious Gateway Proxy Access to Appliance-Local Services

Rule Format

QRadar behavioral event-correlation rule

Detection Purpose

Detect remote-access gateway proxy, relay, or WebSocket requests directed toward loopback, link-local, appliance-local, or prohibited management destinations.

Detection Logic

Alert when an external request reaches a mapped remote-access gateway, invokes a proxy, relay, or WebSocket function, references an appliance-local or prohibited destination, and shows evidence of successful connection establishment. Increase confidence when the request targets loopback or link-local addressing, a known appliance-local service, or a prohibited management interface.

Required Telemetry

·        Gateway HTTP, proxy, relay, WebSocket, WAF, or reverse-proxy events.

·        Source IP, destination gateway, URI path, requested host or destination, requested port, response status, protocol-upgrade result, and timestamp.

·        Reference set identifying secure remote-access gateways.

·        Reference sets for loopback, link-local, appliance-local, and prohibited management destinations.

·        Approved testing, support, monitoring, and incident-response records.

Engineering Implementation Instructions

Create custom event properties for the requested host, requested IP, requested destination, proxy function, protocol-upgrade result, and connection result where they are not parsed by the DSM. Normalize IPv4, IPv6, alternate loopback values, and encoded destinations before matching. Do not suppress activity solely because the source appears in an approved reference set. Deploy in test mode before promoting the rule to an offense.

DRI Assessment

This rule is resilient because it detects proxy behavior rather than a CVE name, exploit string, source address, or fixed payload. Detection readiness depends on visibility into the requested destination and successful connection state.

DRI

8.8 / 10

TCR Assessment

Operational tuning confidence is strong when gateway events preserve destination and response details. Authorized testing, vendor support, monitoring, and troubleshooting may resemble portions of the behavior.

Operational TCR

8.3 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

Encrypted traffic may prevent external sensors from observing the URI or requested destination. Gateway events may record a successful protocol upgrade without preserving the connected service. Appliance-local loopback traffic may not appear in network flows. This rule cannot prove subsequent command execution or authentication-material theft.

Detection Query Pattern

Use this pattern as an implementation guide and map event properties, building blocks, and reference sets to the QRadar deployment.

WHEN an event is detected by

  Remote-Access Gateway HTTP,

  Proxy,

  Relay,

  WebSocket,

  WAF,

  or Reverse-Proxy log sources

AND when the Destination IP is contained in

  ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES

AND when the Source IP is not contained in

  ENV_INTERNAL_ADDRESS_RANGES

AND when Gateway Function is one of

  proxy,

  relay,

  websocket_proxy

AND when any of the following are true:

  Requested IP is contained in

    ENV_LOOPBACK_ADDRESS_RANGES

  Requested IP is contained in

    ENV_LINK_LOCAL_ADDRESS_RANGES

  Requested Host is contained in

    ENV_GATEWAY_LOCAL_HOSTNAMES

  Requested Destination is contained in

    ENV_GATEWAY_LOCAL_SERVICES

  Requested Destination is contained in

    ENV_PROHIBITED_GATEWAY_DESTINATIONS

AND when any of the following are true:

  HTTP Status equals 101

  Protocol Upgrade equals websocket

  Proxy Connection Result equals success

  Relay Session Created equals true

THEN create or add to an offense

  indexed by Destination IP

Rule

Unauthorized Gateway Configuration or Hotfix Activity

Rule Format

QRadar appliance-administration event rule

Detection Purpose

Detect unexpected hotfix-removal, configuration, route, service, script, or filesystem activity on a secure remote-access gateway outside approved administrative workflows.

Detection Logic

Alert when a mapped remote-access gateway records a hotfix-removal action, configuration change, route modification, service change, script execution, or suspicious path-related event that does not match an approved administrator, maintenance window, vendor-support action, or change record. Increase confidence when traversal patterns, temporary scripts, unusual paths, unauthorized configuration objects, or repeated administrative changes are present.

Required Telemetry

·        Gateway administrative, audit, hotfix, configuration, route, service, and system events.

·        Administrator, action, object, path, command, result, appliance, and timestamp properties.

·        Approved administrator accounts, support identities, maintenance windows, hotfix activity, and change records.

·        Known-good gateway configuration and route baselines.

·        Reference set identifying secure remote-access gateways.

Engineering Implementation Instructions

Create custom event properties for administrative action, object, path, command, and hotfix identifier where needed. Maintain reference sets for prohibited gateway objects, approved administrators, vendor-support identities, and approved changes. Include approval start and end times in the change-management reference data. Require analyst review when the event does not preserve the initiating process or request.

DRI Assessment

This rule is durable because it detects unauthorized appliance modification rather than one exploit path. Detection readiness depends on administrative and configuration-event visibility from the gateway.

DRI

8.7 / 10

TCR Assessment

Operational tuning confidence is strong when approved change and maintenance records are available. Legitimate hotfix removal, configuration restoration, troubleshooting, and vendor-support activity may produce similar events.

Operational TCR

8.2 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

Some gateways may not expose detailed command, process, or filesystem telemetry. Approved maintenance records may be incomplete or delayed. Attackers may modify the appliance without generating a distinct administrative event. This rule cannot independently determine whether the change resulted from external exploitation.

Detection Query Pattern

Use this pattern as an implementation guide and map event properties, building blocks, and reference sets to the QRadar deployment.

WHEN an event is detected by

  Remote-Access Gateway Audit,

  Administrative,

  System,

  Configuration,

  or Hotfix log sources

AND when the Destination IP is contained in

  ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES

AND when any of the following are true:

  Administrative Action is one of

    remove_hotfix,

    delete_hotfix,

    modify_configuration,

    add_route,

    modify_route,

    create_service,

    modify_service,

    execute_script

  Target Path contains ../

  Target Path starts with /tmp/

  Target Path starts with /var/tmp/

  Configuration Object is contained in

    ENV_PROHIBITED_GATEWAY_OBJECTS

AND when the event does not match an active approved change

  for the same gateway,

  administrator,

  action,

  object,

  path,

  and event time

THEN create or add to an offense

  indexed by Destination IP

Rule

Gateway-Originated Authentication Without Expected Context

Rule Format

QRadar identity and VPN-session correlation rule

Detection Purpose

Detect successful authentication originating from a secure remote-access gateway when no active remote-access session or approved gateway service context can be identified.

Detection Logic

Alert when a mapped gateway authenticates to an internal identity service, the activity does not match an active VPN session or approved directory-service workflow, and at least one meaningful baseline deviation is present. Increase confidence when the account, workstation name, destination, protocol, or timing differs from the established gateway baseline.

Required Telemetry

·        Domain-controller, LDAP, Kerberos, NTLM, SMB, or identity-service authentication events.

·        VPN and remote-access session records.

·        Gateway asset and address mapping.

·        Approved gateway service accounts, workstation names, identity destinations, authentication protocols, and service windows.

·        Source IP, destination IP, account, workstation name, authentication protocol, logon type, session identifier, and timestamp.

Engineering Implementation Instructions

Map each gateway to its approved directory accounts, identity destinations, protocols, and service windows. Correlate authentication with active VPN sessions using gateway identity, session identifiers, assigned client addresses, and timestamp overlap. Treat missing VPN session telemetry as a limitation rather than proof of malicious activity. Require absent expected context plus at least one baseline deviation before creating an offense.

DRI Assessment

This rule is durable because unexplained authentication originating from a trusted gateway remains suspicious across multiple exploit paths. Detection readiness depends on complete session telemetry, accurate gateway mapping, and reliable identity properties.

DRI

8.8 / 10

TCR Assessment

Operational tuning confidence is moderate to strong. Legitimate directory synchronization, health checks, service-account use, delayed ingestion, and incomplete VPN session records may create apparent mismatches.

Operational TCR

8.0 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

VPN session events may be incomplete, delayed, or stored separately from authentication telemetry. Workstation names may be absent, inconsistent, or spoofed. Gateway service accounts may legitimately authenticate without an end-user session. This rule cannot independently determine how the gateway or account was compromised.

Detection Query Pattern

Use this pattern as an implementation guide and map event properties, building blocks, and reference sets to the QRadar deployment.

WHEN a successful authentication event is detected

AND when the Source IP is contained in

  ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES

AND when the Destination IP is contained in

  ENV_INTERNAL_IDENTITY_SERVICES

AND when Authentication Protocol is one of

  ldap,

  ldaps,

  kerberos,

  ntlm,

  smb

AND when VPN session telemetry is available

AND when no active VPN or remote-access session matches

  the same gateway,

  session identifier or assigned client address,

  and authentication event time

AND when the event does not match

  ENV_APPROVED_GATEWAY_SERVICE_CONTEXT

AND when any of the following are true:

  Account is not contained in

    ENV_APPROVED_GATEWAY_SERVICE_ACCOUNTS

  Workstation Name is present and not contained in

    ENV_APPROVED_GATEWAY_WORKSTATION_NAMES

  Destination IP is not contained in

    ENV_APPROVED_GATEWAY_IDENTITY_DESTINATIONS

  Authentication Protocol is not contained in

    ENV_APPROVED_GATEWAY_AUTH_PROTOCOLS

  Event Time is outside

    ENV_APPROVED_GATEWAY_SERVICE_WINDOWS

THEN create or add to an offense

  indexed by Source IP

SIGMA

Detection Viability Assessment

SIGMA has two rules for this EXP report.

·        SIGMA is viable for expressing portable detection logic for suspicious remote-access gateway proxy behavior and unauthorized gateway configuration or hotfix activity.

·        SIGMA is strongest when gateway HTTP, proxy, WebSocket, administrative, configuration, and system events are normalized into consistent fields before conversion to the destination SIEM.

·        SIGMA cannot perform all gateway-specific enrichment, approval validation, session correlation, or asset mapping without supporting SIEM lookups and implementation logic.

·        SIGMA cannot independently confirm appliance-local command execution, credential theft, session-database access, or TOTP-seed theft when the gateway does not expose those events.

·        The rules are portable detection templates and must be adapted to the gateway log schema and target SIEM before production deployment.

Rule

Suspicious Gateway Proxy Access to Appliance-Local Services

Rule Format

SIGMA YAML behavioral gateway-web template

Detection Purpose

Detect remote-access gateway proxy, relay, or WebSocket requests directed toward loopback, link-local, localhost, or known appliance-local destinations with evidence of successful connection establishment.

Detection Logic

Alert when a gateway web event invokes a proxy, relay, or WebSocket function, references an appliance-local destination, and records a successful proxy connection, relay session, or WebSocket upgrade. Apply remote-access gateway asset filtering and external-source validation in the destination SIEM.

Required Telemetry

·        Gateway HTTP, proxy, relay, WebSocket, WAF, or reverse-proxy events.

·        Requested host, requested IP, requested destination, gateway function, HTTP status, protocol-upgrade result, connection result, and source address.

·        Asset inventory identifying secure remote-access gateways.

·        Environment-specific appliance-local and prohibited destination lists.

·        Approved testing, support, monitoring, and incident-response records.

Engineering Implementation Instructions

Map the custom gateway fields to the normalized schema used by the destination SIEM. Restrict the converted rule to known secure remote-access gateway assets and external source addresses. Extend the destination selections with vendor-specific appliance-local services and management interfaces. Deploy in hunt mode before alert promotion.

DRI Assessment

This rule is resilient because it detects proxy behavior rather than a CVE name, exploit string, source address, or fixed payload. Detection readiness depends on gateway logs preserving the requested destination and connection result.

DRI

8.5 / 10

TCR Assessment

Operational tuning confidence is strong when gateway request logs preserve destination and response details. Authorized testing, vendor support, monitoring, and troubleshooting may resemble portions of the behavior.

Operational TCR

8.1 / 10

Full-Telemetry TCR

8.9 / 10

Limitations

SIGMA does not natively provide asset lookup, network-zone, or change-approval correlation. Appliance-local destinations vary by gateway vendor and deployment. Encrypted traffic or incomplete gateway logging may hide the requested destination. This rule cannot prove subsequent command execution or authentication-material theft.

Detection Query Pattern

Use this portable SIGMA template as an implementation guide and map the custom fields to the gateway telemetry and destination SIEM.

title: Suspicious Gateway Proxy Access to Appliance-Local Services

id: 3a624920-2771-4c8e-bdd5-d64445ebd7b1

status: experimental

description: Detects successful remote-access gateway proxy, relay, or WebSocket activity directed toward appliance-local destinations.

logsource:

  category: webserver

  product: gateway

detection:

  selection_function:

    gateway_function:

      - proxy

      - relay

      - websocket_proxy

  selection_local_ipv4:

    requested_ip|startswith:

      - '127.'

      - '169.254.'

  selection_local_ipv6:

    requested_ip:

      - '::1'

  selection_local_host:

    requested_host:

      - localhost

      - ip6-localhost

  selection_local_destination:

    requested_destination|contains:

      - localhost

      - loopback

      - appliance-local

      - local-management

  selection_success:

    http_status:

      - 101

    protocol_upgrade:

      - websocket

    proxy_connection_result:

      - success

    relay_session_created:

      - true

  condition: selection_function and 1 of selection_local_* and 1 of selection_success

fields:

  - source_ip

  - destination_ip

  - uri_path

  - requested_host

  - requested_ip

  - requested_destination

  - requested_port

  - gateway_function

  - http_status

  - protocol_upgrade

  - proxy_connection_result

  - session_id

falsepositives:

  - Authorized vulnerability testing

  - Vendor support activity

  - Approved gateway troubleshooting

level: high

Rule

Unauthorized Gateway Configuration or Hotfix Activity

Rule Format

SIGMA YAML appliance-administration template

Detection Purpose

Detect hotfix-removal, configuration, route, service, script, or suspicious filesystem activity on a secure remote-access gateway outside approved administrative workflows.

Detection Logic

Alert when a gateway administrative or system event records a high-risk change, traversal pattern, temporary script path, or prohibited configuration object. Apply approved administrator, maintenance-window, vendor-support, and active change-record exclusions in the destination SIEM.

Required Telemetry

·        Gateway administrative, audit, hotfix, configuration, route, service, and system events.

·        Administrator, action, object, path, command, result, appliance, and timestamp fields.

·        Asset inventory identifying secure remote-access gateways.

·        Approved administrators, vendor-support identities, maintenance windows, hotfix activity, and change records.

·        Environment-specific prohibited gateway objects and paths.

Engineering Implementation Instructions

Map the custom administrative fields to the destination SIEM schema. Restrict the converted rule to known secure remote-access gateway assets. Implement approval and maintenance-window exclusions outside the portable SIGMA template using active, time-bounded change data. Require analyst review when the gateway does not preserve the initiating process or request.

DRI Assessment

This rule is durable because it detects unauthorized appliance modification rather than one exploit path. Detection readiness depends on administrative, configuration, and system-event visibility from the gateway.

DRI

8.4 / 10

TCR Assessment

Operational tuning confidence is strong when approved change and maintenance records are available. Legitimate hotfix removal, configuration restoration, troubleshooting, and vendor-support activity may produce similar events.

Operational TCR

8.0 / 10

Full-Telemetry TCR

8.9 / 10

Limitations

SIGMA cannot independently validate active change records or maintenance windows. Some gateways may not expose detailed command, process, or filesystem telemetry. Attackers may modify the appliance without generating a distinct administrative event. This rule cannot determine whether the activity resulted from external exploitation.

Detection Query Pattern

Use this portable SIGMA template as an implementation guide and apply environment-specific approval exclusions after conversion.

title: Unauthorized Gateway Configuration or Hotfix Activity

id: c21ad760-ea16-48f2-91e8-049f6d9602e4

status: experimental

description: Detects high-risk administrative, configuration, hotfix, route, service, script, or filesystem activity on a remote-access gateway.

logsource:

  category: application

  product: gateway

detection:

  selection_action:

    action:

      - remove_hotfix

      - delete_hotfix

      - modify_configuration

      - add_route

      - modify_route

      - create_service

      - modify_service

      - execute_script

  selection_path:

    target_path|contains:

      - '../'

      - '/tmp/'

      - '/var/tmp/'

  selection_object:

    configuration_object|contains:

      - prohibited

      - unauthorized

      - local-management

      - system-service

  condition: 1 of selection_*

fields:

  - destination_ip

  - gateway_name

  - user

  - source_ip

  - action

  - configuration_object

  - target_path

  - command

  - result

falsepositives:

  - Approved gateway maintenance

  - Authorized hotfix removal

  - Vendor support activity

  - Configuration restoration

level: high

YARA

YARA Coverage Disposition

YARA has zero deployable rules for this EXP report.

YARA is not viable as a primary S25 detection system because the report’s detection model is behavioral, sequence-based, gateway-telemetry driven, proxy and relay activity based, authentication-context based, appliance-administration based, network-correlation based, and identity-pivoting based rather than static-file, malware-signature, or artifact-matching based.

YARA may provide limited supporting value only if a confirmed malicious exploit file, script artifact, web component, loader, dropper, appliance implant, credential-theft utility, session-database collection tool, TOTP-seed harvesting artifact, persistence mechanism, post-exploitation payload, or reusable malware-family artifact is recovered and independently validated.

Final YARA Outcome

No YARA rules survive.

AWS

Detection Viability Assessment

AWS has one rule for this EXP report.

·        AWS is viable only when secure remote-access gateway activity is reflected in AWS network, identity, load-balancer, or workload telemetry.

·        AWS is strongest when VPC Flow Logs, CloudTrail, Elastic Load Balancing logs, Route 53 Resolver logs, AWS Network Firewall logs, and workload telemetry are available.

·        AWS can provide supporting correlation for suspicious gateway-originated access to AWS-hosted identity, management, storage, backup, or workload resources.

·        AWS generally cannot observe appliance-local proxy exploitation, gateway configuration manipulation, session-database access, credential theft, or TOTP-seed theft occurring inside an external remote-access appliance.

·        AWS findings must not be promoted as confirmed gateway compromise without corroborating gateway, identity, endpoint, or incident-response evidence.

Rule

Suspicious AWS Resource Access Originating From a Remote-Access Gateway

Rule Format

Amazon Athena SQL supporting network and activity-correlation rule

Detection Purpose

Detect unusual access from a mapped secure remote-access gateway to AWS-hosted administrative, identity, storage, backup, or workload resources after suspicious gateway activity has been identified.

Detection Logic

Alert when a mapped remote-access gateway initiates new, rare, unapproved, or administratively sensitive communication with AWS resources and the activity falls outside the gateway’s established role. Increase confidence when the gateway reaches identity infrastructure, management interfaces, backup systems, storage services, sensitive workloads, or multiple AWS resources within a short period.

Required Telemetry

·        VPC Flow Logs, AWS Network Firewall logs, Elastic Load Balancing logs, or other AWS network telemetry.

·        CloudTrail events where gateway-originated API or console activity can be identified.

·        Source IP, destination IP, destination port, protocol, AWS account, Region, resource identifier, action, result, and timestamp.

·        Asset mapping for secure remote-access gateway addresses.

·        Approved AWS destinations, ports, protocols, administrative paths, maintenance windows, and support activity.

·        Resource role and criticality enrichment.

Engineering Implementation Instructions

Map all gateway addresses, translated addresses, clustered nodes, and cloud-connected interfaces. Establish gateway-specific AWS destination, port, protocol, and service baselines. Require unusual or unapproved activity in addition to the gateway source. Treat access to high-value AWS resources as severity enrichment rather than proof of malicious activity. Do not promote the rule without corroboration from gateway, identity, endpoint, or incident-response telemetry.

DRI Assessment

This rule is resilient because it detects abnormal downstream use of the gateway against AWS resources rather than relying on a specific vulnerability, payload, or source address. Detection readiness depends on accurate gateway attribution and complete AWS network or activity telemetry.

DRI

7.8 / 10

TCR Assessment

Operational tuning confidence is moderate. Legitimate administration, backup operations, monitoring, hybrid-cloud access, support activity, and network changes may introduce new gateway-to-AWS communication.

Operational TCR

7.4 / 10

Full-Telemetry TCR

8.6 / 10

Limitations

AWS may see only the gateway’s translated address and not the original remote user or external source. VPC Flow Logs do not identify the command, account, or action performed. Approved hybrid-cloud communication may resemble portions of the behavior. This rule cannot independently confirm that the remote-access gateway was exploited.

Detection Query Pattern

Use this native Amazon Athena SQL pattern as an implementation guide. Replace the table, field, gateway-address, approved-resource, port, protocol, service, and resource-role placeholders with local AWS environment data. Athena supports the SELECT, FROM, WHERE, IN, CASE, and output-alias structure used below.

SELECT

    event_time AS timestamp,

    source_ip,

    destination_ip,

    destination_port,

    protocol,

    aws_account_id,

    aws_region,

    aws_service,

    destination_resource,

    destination_role,

    destination_first_seen_status,

    activity_name,

    activity_result,

    CASE

        WHEN aws_service IN (

            ENV_HIGH_VALUE_AWS_SERVICES

        )

        OR destination_role IN (

            ENV_HIGH_VALUE_AWS_RESOURCE_ROLES

        )

        THEN 'high'

        ELSE 'medium'

    END AS severity

FROM

    ENV_AWS_NETWORK_OR_ACTIVITY_TABLE

WHERE

    source_ip IN (

        ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES

    )

    AND destination_resource IS NOT NULL

    AND lower(activity_result) IN (

        'allowed',

        'success'

    )

    AND (

        destination_resource NOT IN (

            ENV_APPROVED_GATEWAY_AWS_DESTINATIONS

        )

        OR destination_port NOT IN (

            ENV_APPROVED_GATEWAY_AWS_PORTS

        )

        OR lower(protocol) NOT IN (

            ENV_APPROVED_GATEWAY_AWS_PROTOCOLS

        )

        OR lower(destination_first_seen_status) IN (

            'new',

            'rare'

        )

        OR aws_service IN (

            ENV_HIGH_VALUE_AWS_SERVICES

        )

        OR destination_role IN (

            ENV_HIGH_VALUE_AWS_RESOURCE_ROLES

        )

    )

ORDER BY

    event_time DESC;

Do not promote this rule without corroborating gateway, identity, endpoint, network, or incident-response evidence.

Azure

Detection Viability Assessment

Azure has one rule for this EXP report.

·        Azure is viable only when secure remote-access gateway activity is reflected in Azure network, identity, application, or workload telemetry.

·        Azure is strongest when Microsoft Entra ID logs, Azure Activity Logs, NSG Flow Logs, Azure Firewall logs, Application Gateway logs, VPN telemetry, and workload logs are available.

·        Azure can provide supporting correlation for suspicious gateway-originated access to Azure-hosted identity, management, storage, backup, or workload resources.

·        Azure generally cannot observe appliance-local proxy exploitation, gateway configuration manipulation, session-database access, credential theft, or TOTP-seed theft occurring inside an external remote-access appliance.

·        Azure findings must not be promoted as confirmed gateway compromise without corroborating gateway, identity, endpoint, or incident-response evidence.

Rule

Suspicious Azure Resource Access Originating From a Remote-Access Gateway

Rule Format

Microsoft Sentinel KQL supporting network and activity-correlation rule

Detection Purpose

Detect unusual access from a mapped secure remote-access gateway to Azure-hosted identity, administrative, storage, backup, or workload resources after suspicious gateway activity has been identified.

Detection Logic

Alert when a mapped remote-access gateway initiates new, rare, unapproved, or administratively sensitive communication with Azure resources and the activity falls outside the gateway’s established role. Increase confidence when the gateway reaches Microsoft Entra ID-integrated services, management interfaces, backup systems, storage resources, sensitive workloads, or multiple Azure resources within a short period.

Required Telemetry

·        NSG Flow Logs, Azure Firewall logs, Application Gateway logs, VPN telemetry, or other Azure network records.

·        Microsoft Entra ID sign-in logs and Azure Activity Logs where gateway-originated activity can be identified.

·        Source IP, destination IP, destination port, protocol, subscription, tenant, Region, resource identifier, action, result, and timestamp.

·        Asset mapping for secure remote-access gateway addresses.

·        Approved Azure destinations, ports, protocols, administrative paths, maintenance windows, and support activity.

·        Resource role and criticality enrichment.

Engineering Implementation Instructions

Map all gateway addresses, translated addresses, clustered nodes, and cloud-connected interfaces. Establish gateway-specific Azure destination, port, protocol, service, and resource baselines. Require unusual or unapproved activity in addition to the gateway source. Treat access to high-value Azure resources as severity enrichment rather than proof of malicious activity. Do not promote the rule without corroboration from gateway, identity, endpoint, or incident-response telemetry.

DRI Assessment

This rule is resilient because it detects abnormal downstream use of the gateway against Azure resources rather than relying on a specific vulnerability, payload, or source address. Detection readiness depends on accurate gateway attribution and complete Azure network or activity telemetry.

DRI

7.9 / 10

TCR Assessment

Operational tuning confidence is moderate. Legitimate administration, backup operations, monitoring, hybrid-cloud access, support activity, and network changes may introduce new gateway-to-Azure communication.

Operational TCR

7.5 / 10

Full-Telemetry TCR

8.7 / 10

Limitations

Azure may see only the gateway’s translated address and not the original remote user or external source. Flow telemetry does not identify the command, account, or action performed. Approved hybrid-cloud communication may resemble portions of the behavior. This rule cannot independently confirm that the remote-access gateway was exploited.

Detection Query Pattern

Use this native Microsoft Sentinel KQL pattern as an implementation guide. Replace the table, field, gateway-address, approved-resource, port, protocol, service, and resource-role placeholders with local Azure environment data.

ENV_AZURE_NETWORK_OR_ACTIVITY_TABLE

| where source_ip in (ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES)

| where isnotempty(destination_resource)

| where tolower(activity_result) in ("allowed", "success")

| where

    destination_resource !in (ENV_APPROVED_GATEWAY_AZURE_DESTINATIONS)

    or destination_port !in (ENV_APPROVED_GATEWAY_AZURE_PORTS)

    or tolower(protocol) !in (ENV_APPROVED_GATEWAY_AZURE_PROTOCOLS)

    or tolower(destination_first_seen_status) in ("new", "rare")

    or azure_service in (ENV_HIGH_VALUE_AZURE_SERVICES)

    or destination_role in (ENV_HIGH_VALUE_AZURE_RESOURCE_ROLES)

| extend severity = case(

    azure_service in (ENV_HIGH_VALUE_AZURE_SERVICES)

        or destination_role in (ENV_HIGH_VALUE_AZURE_RESOURCE_ROLES),

    "high",

    "medium"

)

| project

    timestamp,

    source_ip,

    destination_ip,

    destination_port,

    protocol,

    azure_tenant_id,

    azure_subscription_id,

    azure_region,

    azure_service,

    destination_resource,

    destination_role,

    destination_first_seen_status,

    activity_name,

    activity_result,

    severity

| order by timestamp desc

Do not promote this rule without corroborating gateway, identity, endpoint, network, or incident-response evidence.

GCP

Detection Viability Assessment

GCP has one rule for this EXP report.

·        GCP is viable only when secure remote-access gateway activity is reflected in Google Cloud network, identity, administrative, or workload telemetry.

·        GCP is strongest when VPC Flow Logs, Cloud Audit Logs, Cloud Load Balancing logs, Cloud DNS logs, firewall telemetry, and workload logs are available.

·        GCP can provide supporting correlation for suspicious gateway-originated access to Google Cloud-hosted identity, management, storage, backup, or workload resources.

·        GCP generally cannot observe appliance-local proxy exploitation, gateway configuration manipulation, session-database access, credential theft, or TOTP-seed theft occurring inside an external remote-access appliance.

·        GCP findings must not be promoted as confirmed gateway compromise without corroborating gateway, identity, endpoint, or incident-response evidence.

Rule

Suspicious GCP Resource Access Originating From a Remote-Access Gateway

Rule Format

Google BigQuery GoogleSQL supporting network and activity-correlation rule

Detection Purpose

Detect unusual access from a mapped secure remote-access gateway to Google Cloud-hosted identity, administrative, storage, backup, or workload resources after suspicious gateway activity has been identified.

Detection Logic

Alert when a mapped remote-access gateway initiates new, rare, unapproved, or administratively sensitive communication with Google Cloud resources and the activity falls outside the gateway’s established role. Increase confidence when the gateway reaches identity services, management interfaces, backup systems, storage resources, sensitive workloads, or multiple Google Cloud resources within a short period.

Required Telemetry

·        VPC Flow Logs, firewall logs, Cloud Load Balancing logs, Cloud DNS logs, or other Google Cloud network telemetry.

·        Cloud Audit Logs where gateway-originated administrative or API activity can be identified.

·        Source IP, destination IP, destination port, protocol, organization, project, Region, resource identifier, action, result, and timestamp.

·        Asset mapping for secure remote-access gateway addresses.

·        Approved GCP destinations, ports, protocols, administrative paths, maintenance windows, and support activity.

·        Resource role and criticality enrichment.

Engineering Implementation Instructions

Map all gateway addresses, translated addresses, clustered nodes, and cloud-connected interfaces. Establish gateway-specific GCP destination, port, protocol, service, project, and resource baselines. Require unusual or unapproved activity in addition to the gateway source. Treat access to high-value Google Cloud resources as severity enrichment rather than proof of malicious activity. Do not promote the rule without corroboration from gateway, identity, endpoint, or incident-response telemetry.

DRI Assessment

This rule is resilient because it detects abnormal downstream use of the gateway against Google Cloud resources rather than relying on a specific vulnerability, payload, or source address. Detection readiness depends on accurate gateway attribution and complete Google Cloud network or activity telemetry.

DRI

7.8 / 10

TCR Assessment

Operational tuning confidence is moderate. Legitimate administration, backup operations, monitoring, hybrid-cloud access, support activity, and network changes may introduce new gateway-to-GCP communication.

Operational TCR

7.4 / 10

Full-Telemetry TCR

8.6 / 10

Limitations

Google Cloud may see only the gateway’s translated address and not the original remote user or external source. Flow telemetry does not identify the command, account, or action performed. Approved hybrid-cloud communication may resemble portions of the behavior. This rule cannot independently confirm that the remote-access gateway was exploited.

Detection Query Pattern

Use this native Google BigQuery GoogleSQL pattern as an implementation guide. Replace the table, field, gateway-address, approved-resource, port, protocol, service, and resource-role placeholders with local Google Cloud environment data.

SELECT

  event_time AS timestamp,

  source_ip,

  destination_ip,

  destination_port,

  protocol,

  gcp_organization_id,

  gcp_project_id,

  gcp_region,

  gcp_service,

  destination_resource,

  destination_role,

  destination_first_seen_status,

  activity_name,

  activity_result,

  CASE

    WHEN gcp_service IN (

      ENV_HIGH_VALUE_GCP_SERVICES

    )

    OR destination_role IN (

      ENV_HIGH_VALUE_GCP_RESOURCE_ROLES

    )

    THEN 'high'

    ELSE 'medium'

  END AS severity

FROM

  `ENV_GCP_NETWORK_OR_ACTIVITY_TABLE`

WHERE

  source_ip IN (

    ENV_REMOTE_ACCESS_GATEWAY_ADDRESSES

  )

  AND destination_resource IS NOT NULL

  AND LOWER(activity_result) IN (

    'allowed',

    'success'

  )

  AND (

    destination_resource NOT IN (

      ENV_APPROVED_GATEWAY_GCP_DESTINATIONS

    )

    OR destination_port NOT IN (

      ENV_APPROVED_GATEWAY_GCP_PORTS

    )

    OR LOWER(protocol) NOT IN (

      ENV_APPROVED_GATEWAY_GCP_PROTOCOLS

    )

    OR LOWER(destination_first_seen_status) IN (

      'new',

      'rare'

    )

    OR gcp_service IN (

      ENV_HIGH_VALUE_GCP_SERVICES

    )

    OR destination_role IN (

      ENV_HIGH_VALUE_GCP_RESOURCE_ROLES

    )

  )

ORDER BY

  event_time DESC;

Do not promote this rule without corroborating gateway, identity, endpoint, network, or incident-response evidence.

S26 — Threat-to-Rule Traceability Matrix

Traceability Purpose

This section maps the primary behavioral threat conditions in this report to the S25 detection coverage developed across NDR / Network Behavioral Analytics, SentinelOne, Splunk, Elastic, QRadar, SIGMA, YARA, AWS, Azure, and GCP.

The traceability model is behavior-led. It does not rely on a single CVE identifier, exploit name, proof-of-concept artifact, repository reference, filename, hash, source IP, URI string, WebSocket path, hotfix identifier, appliance version, RRAS vulnerability identifier, or other static indicator as the basis for coverage.

The governing behavior model is external interaction with a secure remote-access gateway followed by suspicious proxy, relay, or WebSocket access to appliance-local services; unauthorized administrative, configuration, hotfix, route, service, script, or filesystem activity; suspicious execution from a validated Windows RemoteAccess service process; unexplained authentication originating from the gateway; downstream endpoint execution; abnormal internal expansion; or unusual access to AWS, Azure, or Google Cloud resources.

Coverage Scope

The S25 rule set provides coverage for observable enterprise behavior associated with suspicious external access to secure remote-access gateway proxy functions; requests directed toward loopback, link-local, localhost, appliance-local, or prohibited management destinations; successful proxy, relay, or protocol-upgrade activity; unauthorized gateway configuration or hotfix changes; unexpected route, service, script, or filesystem modification; suspicious child-process execution from a validated Windows RemoteAccess service process; gateway-originated authentication without expected VPN-session or service context; suspicious endpoint execution after gateway-originated access; abnormal internal communication from the gateway; and unusual gateway-originated access to AWS, Azure, or Google Cloud resources.

Coverage is strongest where gateway HTTP, proxy, relay, WebSocket, WAF, reverse-proxy, administrative, audit, configuration, hotfix, route, service, and system logs can be joined with Windows RRAS service and process telemetry, RemoteAccess service-process attribution, VPN-session records, authentication events, endpoint telemetry, process activity, network flows, firewall records, NDR telemetry, cloud activity, asset inventories, gateway-address mappings, approved-service context, maintenance records, and gateway-specific communication baselines.

Primary Coverage Areas

·        External requests to mapped secure remote-access gateways that invoke proxy, relay, or WebSocket functions.

·        Requests directed toward loopback, link-local, localhost, appliance-local, or prohibited management destinations.

·        Successful WebSocket upgrades, proxy connections, or relay-session creation involving appliance-local services.

·        Unauthorized hotfix removal, configuration modification, route changes, service changes, script execution, suspicious paths, or prohibited gateway objects.

·        Gateway administrative activity outside approved administrator, maintenance, vendor-support, or change-management context.

·        Suspicious child-process execution from a process positively attributed to the Windows RemoteAccess service on an RRAS server.

·        Suspicious externally sourced RRAS activity followed by validated RemoteAccess service-context execution.

·        Gateway-originated authentication without an active VPN session or approved gateway service workflow.

·        Account, workstation, destination, protocol, or service-window deviations associated with gateway-originated authentication.

·        Suspicious shell, scripting-engine, administrative-utility, credential-access, or discovery execution on protected endpoints after gateway-originated access.

·        Abnormal internal communication from a gateway following suspicious appliance-local proxy or RRAS execution activity.

·        New, rare, unapproved, or high-value internal destinations reached from a remote-access gateway.

·        Unusual gateway-originated access to AWS-hosted identity, management, storage, backup, or workload resources.

·        Unusual gateway-originated access to Azure-hosted identity, administrative, storage, backup, or workload resources.

·        Unusual gateway-originated access to Google Cloud-hosted identity, administrative, storage, backup, or workload resources.

Traceability Mapping

Suspicious Gateway Proxy Access to Appliance-Local Services

This behavior is covered where gateway HTTP, proxy, relay, WebSocket, WAF, reverse-proxy, requested-destination, protocol-upgrade, and connection-result telemetry can identify external requests directed toward appliance-local or prohibited destinations.

Mapped Coverage

·        NDR / Network Behavioral Analytics coverage through Suspicious Gateway Proxy Access to Appliance-Local Services.

·        Splunk coverage through Suspicious Gateway Proxy Access to Appliance-Local Services.

·        Elastic coverage through Suspicious Gateway Proxy Access to Appliance-Local Services.

·        QRadar coverage through Suspicious Gateway Proxy Access to Appliance-Local Services.

·        SIGMA coverage through Suspicious Gateway Proxy Access to Appliance-Local Services.

·        NDR sequence coverage through Suspicious Internal Access Following Gateway Exploitation Activity when the proxy behavior is followed by internal expansion.

·        SentinelOne supporting coverage through Suspicious Endpoint Execution Following Remote-Access Gateway Connection when gateway-originated access is followed by suspicious endpoint execution.

Coverage Qualification

·        Internet exposure alone is not sufficient.

·        Vulnerable firmware alone is not sufficient.

·        A request to the gateway alone is not sufficient.

·        WebSocket traffic alone is not sufficient.

·        A protocol-upgrade response alone is not sufficient.

·        A source IP associated with scanning or exploitation alone is not sufficient.

·        Coverage requires a mapped gateway, proxy or relay behavior, an appliance-local or prohibited destination, and evidence of successful connection establishment.

·        Authorized vulnerability testing, vendor support, monitoring, troubleshooting, and incident-response activity require validation before suppression or downgrade.

·        Encrypted traffic and appliance-local communication may prevent external sensors from observing the requested destination.

Unauthorized Gateway Configuration, Hotfix, Route, Service, Script, or Filesystem Activity

This behavior is covered where gateway administrative, audit, configuration, hotfix, route, service, system, object, path, command, administrator, result, and timestamp telemetry can identify changes outside approved workflows.

Mapped Coverage

·        Splunk coverage through Unauthorized Gateway Configuration or Hotfix Activity.

·        Elastic coverage through Unauthorized Gateway Configuration or Hotfix Activity.

·        QRadar coverage through Unauthorized Gateway Configuration or Hotfix Activity.

·        SIGMA coverage through Unauthorized Gateway Configuration or Hotfix Activity.

·        NDR supporting coverage through Suspicious Internal Access Following Gateway Exploitation Activity when an unauthorized gateway change is followed by abnormal internal communication.

·        SentinelOne does not directly observe appliance-local changes unless the gateway operating system is protected and exposes the required endpoint telemetry.

Coverage Qualification

·        A gateway configuration change alone is not sufficient.

·        Hotfix removal alone is not sufficient.

·        A route change alone is not sufficient.

·        Service creation or modification alone is not sufficient.

·        Script execution alone is not sufficient.

·        A temporary path alone is not sufficient.

·        Coverage requires high-risk administrative behavior plus absent approved administrator, maintenance-window, vendor-support, or active change-record context.

·        Approved patching, restoration, troubleshooting, vendor support, monitoring, incident response, and maintenance require time-bounded validation.

·        Some gateways may not expose the initiating request, process, command, or filesystem activity.

·        Attackers may alter an appliance without generating a distinct administrative event.

Suspicious RRAS Service-Host Execution Following External Network Activity

This behavior is covered where externally sourced network activity against a confirmed Windows RRAS server can be correlated with suspicious child-process execution from a process positively attributed to the RemoteAccess service.

Mapped Coverage

·        SentinelOne coverage through Suspicious RRAS Service-Host Execution Following External Network Activity.

·        Splunk coverage through Suspicious RRAS Service-Host Execution Following External Network Activity.

·        Elastic coverage through Suspicious RRAS Service-Host Execution Following External Network Activity.

·        QRadar coverage through Suspicious RRAS Service-Host Execution Following External Network Activity.

·        SIGMA coverage through Suspicious RRAS Service-Host Child Process Execution, with external-network correlation and RemoteAccess service attribution provided by the destination SIEM or enrichment pipeline.

·        NDR provides supporting network context through externally sourced activity against the RRAS server but does not independently validate Windows service-process lineage.

Coverage Qualification

·        An inbound connection to an RRAS server alone is not sufficient.

·        svchost.exe activity alone is not sufficient.

·        A RemoteAccess service fault, restart, or recovery event alone is not sufficient.

·        Shell, PowerShell, script-host, utility, or administrative-process execution alone is not sufficient.

·        Coverage requires confirmed RRAS host identity, positive RemoteAccess service-process attribution, suspicious child-process behavior, and appropriate network or execution context.

·        RemoteAccess service-process identifiers may change following service or host restart and must be refreshed where process identifiers are used.

·        Command-line conditions are supplemental where command-line telemetry is unavailable.

·        Memory-only exploitation that produces no observable child process may evade the execution rules.

·        The rules detect behavior consistent with exploit-to-execution but do not independently identify which RRAS vulnerability caused the execution.

Gateway-Originated Authentication Without Expected Context

This behavior is covered where authentication, identity-service, VPN-session, gateway-address, account, workstation, protocol, destination, and service-window telemetry can establish that successful authentication originated from a remote-access gateway without the expected session or service context.

Mapped Coverage

·        NDR / Network Behavioral Analytics coverage through Gateway-Originated Authentication Without Expected Context.

·        Splunk coverage through Gateway-Originated Authentication Without Expected Context.

·        Elastic coverage through Gateway-Originated Authentication Without Expected Context.

·        QRadar coverage through Gateway-Originated Authentication Without Expected Context.

·        SentinelOne supporting coverage where gateway-originated activity reaches a protected endpoint and is followed by suspicious execution.

·        AWS, Azure, and GCP supporting coverage where the gateway subsequently accesses cloud-hosted identity, management, or workload resources.

Coverage Qualification

·        Gateway-originated authentication alone is not sufficient.

·        A service-account logon alone is not sufficient.

·        A missing workstation name alone is not sufficient.

·        An unusual authentication protocol alone is not sufficient.

·        The absence of a matching session cannot be treated as malicious when VPN-session telemetry is unavailable.

·        Coverage requires absent active-session or approved-service context plus at least one meaningful account, workstation, destination, protocol, or timing deviation.

·        Approved directory synchronization, health checks, monitoring, service-account use, support, maintenance, and delayed log ingestion require baseline validation.

·        Workstation names and session identifiers may be absent, inconsistent, delayed, or spoofed.

·        The rule cannot independently determine whether the gateway, account, session, or authentication material was compromised.

Suspicious Endpoint Execution Following Gateway-Originated Access

This behavior is covered where SentinelOne network and process telemetry can correlate gateway-originated access with subsequent suspicious execution on the same protected endpoint within a bounded time window.

Mapped Coverage

·        SentinelOne coverage through Suspicious Endpoint Execution Following Remote-Access Gateway Connection.

·        Splunk, Elastic, and QRadar provide supporting coverage where endpoint network and process telemetry are ingested and correlated.

·        NDR supporting coverage through Suspicious Internal Access Following Gateway Exploitation Activity when the endpoint connection forms part of broader internal expansion.

Coverage Qualification

·        A connection from a gateway alone is not sufficient.

·        Shell execution alone is not sufficient.

·        PowerShell, command-shell, script-host, interpreter, or administrative-utility execution alone is not sufficient.

·        An approved administrator account alone is not sufficient for suppression.

·        An approved remote-management process alone is not sufficient for suppression.

·        Coverage requires a gateway-originated connection followed by suspicious process execution on the same SentinelOne agent within the configured correlation window.

·        Approved remote administration, help-desk activity, software deployment, vulnerability scanning, monitoring, troubleshooting, incident response, and maintenance require full workflow validation.

·        SentinelOne may observe the gateway address without preserving the original external source or remote user.

·        The rule detects downstream endpoint behavior and does not independently prove appliance compromise.

Suspicious Internal Access Following Gateway Exploitation Activity

This behavior is covered where suspicious appliance-local proxy or validated RRAS execution activity can be correlated with subsequent network communication from the same gateway or RRAS host to new, rare, unapproved, or high-value internal destinations.

Mapped Coverage

·        NDR / Network Behavioral Analytics coverage through Suspicious Internal Access Following Gateway Exploitation Activity.

·        Splunk, Elastic, and QRadar supporting coverage where gateway web events, RRAS execution events, internal flows, asset roles, and gateway baselines are centrally correlated.

·        SentinelOne supporting coverage where the destination endpoint records suspicious process execution following the gateway connection.

·        AWS, Azure, and GCP supporting coverage where the internal expansion reaches cloud-connected or cloud-hosted resources.

Coverage Qualification

·        Internal gateway communication alone is not sufficient.

·        Access to a domain controller alone is not sufficient.

·        Access to a high-value system alone is not sufficient.

·        A new internal destination alone is not sufficient.

·        A failed connection alone is not sufficient.

·        Coverage requires preceding suspicious gateway or RRAS behavior plus anomalous destination, port, protocol, rarity, destination diversity, or failed-connection behavior.

·        High-value asset access increases severity but does not independently establish compromise.

·        Approved directory access, monitoring, backup, management, orchestration, support, testing, incident response, and maintenance require gateway-specific baseline validation.

·        Low-volume access to an already approved destination may evade detection.

·        Network telemetry may not identify the command, account, or action performed.

Potential Credential, Session, or TOTP Material Exposure

The report identifies credential, session, and TOTP material as potential consequences of remote-access gateway compromise. S25 does not directly confirm access to or theft of that material unless the gateway exposes sufficiently detailed audit, process, file, database, or session telemetry.

Mapped Coverage

·        NDR coverage through Gateway-Originated Authentication Without Expected Context when stolen authentication material is used from the gateway.

·        Splunk, Elastic, and QRadar coverage through Gateway-Originated Authentication Without Expected Context.

·        SentinelOne supporting coverage when stolen access is followed by suspicious endpoint execution.

·        AWS, Azure, and GCP supporting coverage when stolen identity or session material is used against cloud-hosted resources.

·        Unauthorized gateway configuration or hotfix rules provide supporting evidence where trust, session, or authentication behavior changes are recorded by the appliance.

·        RRAS service-host execution rules provide supporting evidence where suspicious execution precedes authentication-material misuse but do not independently prove credential or session theft.

Coverage Qualification

·        A successful login alone is not sufficient.

·        A reused account alone is not sufficient.

·        Session creation alone is not sufficient.

·        TOTP use alone is not sufficient.

·        The S25 rules do not directly prove session-database access, password theft, token theft, credential extraction, or TOTP-seed theft.

·        Coverage depends on subsequent anomalous authentication, RRAS or endpoint execution, administrative change, internal expansion, or cloud-resource access.

·        Direct confirmation requires gateway, database, file, memory, session, authentication, or incident-response evidence.

AWS Resource Access Originating From a Remote-Access Gateway

This behavior is covered where VPC Flow Logs, AWS Network Firewall logs, Elastic Load Balancing logs, CloudTrail, or related AWS telemetry can identify unusual gateway-originated access to AWS resources.

Mapped Coverage

·        AWS coverage through Suspicious AWS Resource Access Originating From a Remote-Access Gateway.

·        Splunk, Elastic, and QRadar provide supporting coverage where AWS telemetry and gateway context are ingested into the same analytics environment.

·        NDR provides supporting coverage through Suspicious Internal Access Following Gateway Exploitation Activity where AWS-connected resources are reached through internal or hybrid paths.

Coverage Qualification

·        An AWS connection from the gateway alone is not sufficient.

·        Access to a high-value AWS service alone is not sufficient.

·        CloudTrail activity alone is not sufficient.

·        A new destination alone is not sufficient.

·        Coverage requires new, rare, unapproved, role-inconsistent, or administratively sensitive activity from a mapped gateway.

·        Access to high-value AWS resources increases severity but does not independently establish compromise.

·        AWS may observe only a translated gateway address and not the original external source or user.

·        Approved hybrid-cloud access, administration, backup, monitoring, automation, vendor support, and incident response require local baseline validation.

·        The AWS rule must not be promoted without corroborating gateway, identity, endpoint, RRAS, or incident-response evidence.

Azure Resource Access Originating From a Remote-Access Gateway

This behavior is covered where NSG Flow Logs, Azure Firewall logs, Application Gateway logs, Microsoft Entra ID sign-in logs, Azure Activity Logs, VPN telemetry, or related Azure records can identify unusual gateway-originated access to Azure resources.

Mapped Coverage

·        Azure coverage through Suspicious Azure Resource Access Originating From a Remote-Access Gateway.

·        Splunk, Elastic, and QRadar provide supporting coverage where Azure telemetry and gateway context are ingested into the same analytics environment.

·        NDR provides supporting coverage through Suspicious Internal Access Following Gateway Exploitation Activity where Azure-connected resources are reached through internal or hybrid paths.

Coverage Qualification

·        An Azure connection from the gateway alone is not sufficient.

·        Microsoft Entra ID activity alone is not sufficient.

·        Azure Activity Log activity alone is not sufficient.

·        Access to a high-value Azure service alone is not sufficient.

·        Coverage requires new, rare, unapproved, role-inconsistent, or administratively sensitive activity from a mapped gateway.

·        Access to high-value Azure resources increases severity but does not independently establish compromise.

·        Azure may observe only a translated gateway address and not the original external source or user.

·        Approved hybrid-cloud access, administration, backup, monitoring, automation, vendor support, and incident response require local baseline validation.

·        The Azure rule must not be promoted without corroborating gateway, identity, endpoint, RRAS, or incident-response evidence.

GCP Resource Access Originating From a Remote-Access Gateway

This behavior is covered where VPC Flow Logs, firewall logs, Cloud Load Balancing logs, Cloud DNS logs, Cloud Audit Logs, or related Google Cloud telemetry can identify unusual gateway-originated access to Google Cloud resources.

Mapped Coverage

·        GCP coverage through Suspicious GCP Resource Access Originating From a Remote-Access Gateway.

·        Splunk, Elastic, and QRadar provide supporting coverage where Google Cloud telemetry and gateway context are ingested into the same analytics environment.

·        NDR provides supporting coverage through Suspicious Internal Access Following Gateway Exploitation Activity where Google Cloud-connected resources are reached through internal or hybrid paths.

Coverage Qualification

·        A Google Cloud connection from the gateway alone is not sufficient.

·        Cloud Audit Log activity alone is not sufficient.

·        Access to a high-value Google Cloud service alone is not sufficient.

·        A new destination alone is not sufficient.

·        Coverage requires new, rare, unapproved, role-inconsistent, or administratively sensitive activity from a mapped gateway.

·        Access to high-value Google Cloud resources increases severity but does not independently establish compromise.

·        Google Cloud may observe only a translated gateway address and not the original external source or user.

·        Approved hybrid-cloud access, administration, backup, monitoring, automation, vendor support, and incident response require local baseline validation.

·        The GCP rule must not be promoted without corroborating gateway, identity, endpoint, RRAS, or incident-response evidence.

NDR / Network Behavioral Analytics Coverage Disposition

NDR / Network Behavioral Analytics provides primary network-behavior coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Gateway-Originated Authentication Without Expected Context, and Suspicious Internal Access Following Gateway Exploitation Activity.

NDR can identify suspicious appliance-local proxy behavior, unexplained gateway-originated authentication, abnormal internal expansion, and externally sourced network activity involving RRAS servers but cannot independently validate RemoteAccess service-process attribution, Windows child-process execution, appliance-local command execution, configuration manipulation, credential theft, session-database access, or TOTP-seed theft.

NDR coverage depends on gateway-request visibility, requested-destination parsing, successful connection indicators, gateway and RRAS asset mapping, VPN-session correlation, identity telemetry, internal flow visibility, destination enrichment, gateway-specific communication baselines, approved-service context, and bounded-time correlation.

SentinelOne Coverage Disposition

SentinelOne provides primary downstream endpoint-behavior coverage through Suspicious Endpoint Execution Following Remote-Access Gateway Connection and Windows RRAS execution coverage through Suspicious RRAS Service-Host Execution Following External Network Activity.

The downstream endpoint rule correlates gateway-originated network connections with subsequent suspicious process creation on the same protected endpoint. The RRAS rule correlates externally sourced network activity against a protected RRAS server with suspicious child-process execution from a parent process positively attributed to the RemoteAccess service.

RRAS coverage requires confirmed RRAS host inventory, current RemoteAccess service-process attribution, process ancestry, network telemetry, and approved administration context. SentinelOne should not treat svchost.exe or an inbound RRAS connection alone as compromise.

SentinelOne generally cannot directly observe exploitation or trust-material theft occurring inside a closed remote-access appliance and cannot independently identify which RRAS vulnerability caused observed Windows execution.

Splunk Coverage Disposition

Splunk provides primary SIEM correlation and enrichment coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Unauthorized Gateway Configuration or Hotfix Activity, Gateway-Originated Authentication Without Expected Context, and Suspicious RRAS Service-Host Execution Following External Network Activity.

Coverage depends on normalized gateway web, proxy, administrative, configuration, VPN-session, authentication, identity, asset, endpoint, RRAS service-process, network, lookup, approval, and time-window data.

Splunk can directly correlate suspicious RRAS child-process execution when current RemoteAccess service-process attribution and process telemetry are available, but cannot independently identify the specific exploit responsible or prove credential, session, or TOTP theft without corroborating evidence.

Elastic Coverage Disposition

Elastic provides primary KQL and EQL-aligned coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Unauthorized Gateway Configuration or Hotfix Activity, Gateway-Originated Authentication Without Expected Context, and Suspicious RRAS Service-Host Execution Following External Network Activity.

Coverage depends on Elastic Common Schema or consistent custom-field normalization, gateway enrichment, RRAS host enrichment, validated RemoteAccess service-process context, approved-context enrichment, VPN-session availability, destination mapping, authentication context, and time-bounded sequence logic.

Elastic should not classify isolated WebSocket activity, gateway changes, authentication events, cloud events, RRAS service faults, or generic svchost.exe activity as confirmed gateway or RRAS compromise.

QRadar Coverage Disposition

QRadar provides primary SIEM correlation and offense-generation coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Unauthorized Gateway Configuration or Hotfix Activity, Gateway-Originated Authentication Without Expected Context, and Suspicious RRAS Service-Host Execution Following External Network Activity.

Coverage depends on validated DSM parsing, custom event properties, gateway and RRAS reference sets, internal-address mappings, appliance-local destination reference data, RemoteAccess service-process reference data, approved-change context, VPN-session availability, identity-service mappings, and baseline reference sets.

QRadar can correlate suspicious RRAS service-context execution when the active RemoteAccess service process is correctly mapped but cannot independently determine which exploit produced the behavior or prove credential-theft mechanisms without corroborating evidence.

SIGMA Coverage Disposition

SIGMA provides portable event-rule template coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Unauthorized Gateway Configuration or Hotfix Activity, and Suspicious RRAS Service-Host Child Process Execution.

The RRAS SIGMA rule requires destination-SIEM or ingestion-pipeline enrichment that positively maps the parent process to the RemoteAccess service. Generic svchost.exe process ancestry is insufficient.

SIGMA is useful for backend-mappable event logic but should not be treated as a complete backend-independent asset-enrichment, service-process-attribution, approval-validation, VPN-session-correlation, external-network-correlation, or multi-event sequence-correlation layer.

Local field mapping, backend translation, RRAS host filtering, RemoteAccess service enrichment, external-source validation, approved-change exclusions, maintenance-window validation, enrichment, and SIEM-native correlation remain required.

YARA Coverage Disposition

YARA has zero deployable rules for this EXP report.

YARA is not viable as a primary S25 detection system because the report’s governing model is behavioral, sequence-based, gateway-telemetry driven, Windows service/process-context driven, proxy and relay activity based, authentication-context based, appliance-administration based, endpoint-correlation based, network-expansion based, and cloud-context based rather than static-file, malware-signature, or artifact-matching based.

YARA may provide limited supporting value only if a confirmed malicious exploit file, script artifact, web component, loader, dropper, appliance implant, credential-theft utility, session-database collection tool, TOTP-seed harvesting artifact, persistence mechanism, post-exploitation payload, or reusable malware-family artifact is recovered and independently validated.

Final YARA Outcome

No YARA rules survive.

AWS Coverage Disposition

AWS provides supporting cloud correlation through Suspicious AWS Resource Access Originating From a Remote-Access Gateway.

Coverage depends on accurate gateway-address mapping, VPC Flow Logs, AWS Network Firewall logs, Elastic Load Balancing logs, CloudTrail or related activity records, destination-role enrichment, approved gateway communication baselines, and corroborating gateway, RRAS, identity, endpoint, or incident-response evidence.

AWS does not independently confirm appliance-local or RRAS exploitation.

Azure Coverage Disposition

Azure provides supporting cloud correlation through Suspicious Azure Resource Access Originating From a Remote-Access Gateway.

Coverage depends on accurate gateway-address mapping, NSG Flow Logs, Azure Firewall logs, Application Gateway logs, Microsoft Entra ID sign-in logs, Azure Activity Logs, destination-role enrichment, approved gateway communication baselines, and corroborating gateway, RRAS, identity, endpoint, or incident-response evidence.

Azure does not independently confirm appliance-local or RRAS exploitation.

GCP Coverage Disposition

GCP provides supporting cloud correlation through Suspicious GCP Resource Access Originating From a Remote-Access Gateway.

Coverage depends on accurate gateway-address mapping, VPC Flow Logs, firewall logs, Cloud Load Balancing logs, Cloud DNS logs, Cloud Audit Logs, destination-role enrichment, approved gateway communication baselines, and corroborating gateway, RRAS, identity, endpoint, or incident-response evidence.

GCP does not independently confirm appliance-local or RRAS exploitation.

Coverage Gaps and Non-Coverage Conditions

The S25 rule set does not directly prove the specific server-side request forgery, memory-corruption, code-injection, or other technical exploitation mechanism responsible for gateway or RRAS compromise.

For closed or managed security appliances, the rule set may also lack direct proof of appliance-local command execution, privilege transition, memory access, session-database access, credential extraction, token theft, TOTP-seed theft, or related technical mechanisms.

For Windows RRAS systems, S25 can directly detect suspicious child-process execution from a process positively attributed to RemoteAccess where the required telemetry is available, but that execution evidence does not by itself prove exploitation or identify the vulnerability used.

The S25 rule set also does not independently prove identity compromise, endpoint compromise, successful lateral movement, persistence, data theft, AWS compromise, Azure compromise, or Google Cloud compromise without the required behavior and context linkage.

Coverage Weakens Under the Following Conditions

·        Gateway HTTP, proxy, relay, WebSocket, WAF, reverse-proxy, administrative, audit, configuration, hotfix, route, service, or system logs are missing, delayed, incomplete, or inconsistently normalized.

·        Requested host, requested IP, requested destination, gateway function, response status, protocol-upgrade result, relay-session state, or proxy-connection result is not preserved.

·        Appliance-local loopback or link-local communication never crosses an observable network sensor.

·        Gateway traffic is encrypted and the gateway does not log the requested destination.

·        Remote-access gateway or RRAS asset inventories, clustered-node mappings, virtual-appliance mappings, translated addresses, internal interfaces, or gateway identities are incomplete.

·        RRAS hosts are not positively identified.

·        RemoteAccess service-process attribution is missing, stale, or not refreshed after service or host restart.

·        Windows process ancestry is missing or cannot be joined to current RemoteAccess service context.

·        Command-line telemetry is unavailable where command-line enrichment is required for higher-confidence execution analysis.

·        VPN-session records are missing, delayed, incomplete, or cannot be joined to authentication activity.

·        Gateway service accounts, approved workstation names, identity destinations, authentication protocols, and service windows are incomplete or stale.

·        Authentication telemetry does not preserve source address, account, workstation, protocol, destination, result, session identifier, or timestamp.

·        Gateway administrative events do not preserve the administrator, action, object, path, command, result, or initiating request.

·        Approved administrator, vendor-support, maintenance-window, hotfix, or change-management records are incomplete, stale, or not time-bounded.

·        Endpoint network and process telemetry cannot be correlated through SentinelOne agent identity and event time.

·        Process ancestry, user, executable path, hash, endpoint identity, or available command line is missing or truncated.

·        Internal network-flow telemetry cannot reliably attribute traffic to the remote-access gateway or RRAS host.

·        NAT, proxies, shared addresses, overlays, load balancers, or centralized egress obscure gateway attribution.

·        Gateway-specific approved destination, port, protocol, service, and destination-count baselines are incomplete.

·        Internal asset roles, high-value-system classifications, destination rarity, first-seen status, or criticality enrichment is unavailable.

·        AWS gateway-address mappings, VPC Flow Logs, Network Firewall logs, Elastic Load Balancing logs, CloudTrail records, destination roles, or approved communication baselines are incomplete.

·        Azure gateway-address mappings, NSG Flow Logs, Azure Firewall logs, Application Gateway logs, Microsoft Entra ID logs, Azure Activity Logs, destination roles, or approved communication baselines are incomplete.

·        Google Cloud gateway-address mappings, VPC Flow Logs, firewall logs, Cloud Load Balancing logs, Cloud DNS logs, Cloud Audit Logs, destination roles, or approved communication baselines are incomplete.

·        Cloud platforms observe only a translated gateway address and cannot preserve the original external source, remote user, session, or account context.

·        Adversary activity blends into approved administration, directory synchronization, monitoring, support, backup, software deployment, vulnerability scanning, incident response, testing, or maintenance.

·        Attackers use approved accounts, expected destinations, normal protocols, existing sessions, trusted processes, low-volume activity, or normal service windows.

·        Appliance modifications do not generate distinct administrative, configuration, service, route, script, or filesystem events.

·        RRAS exploitation occurs entirely in memory and produces no observable child process, service anomaly, downstream network activity, or authentication behavior.

·        Credential, session, token, or TOTP material is accessed without producing observable authentication or downstream-use behavior.

·        Security-control degradation removes the telemetry required to confirm subsequent activity.

·        No observable proxy behavior, administrative change, RRAS execution, authentication deviation, endpoint execution, internal expansion, or cloud-resource activity occurs.

Traceability Conclusion

The S25 detection set provides broad behavior-led coverage across suspicious gateway proxy access to appliance-local services, unauthorized gateway configuration or hotfix activity, suspicious Windows RRAS service-host execution, gateway-originated authentication without expected context, suspicious endpoint execution following gateway-originated access, abnormal internal expansion, and unusual downstream AWS, Azure, and Google Cloud resource access.

The strongest direct gateway, RRAS execution, and identity coverage is provided by Splunk, Elastic, QRadar, SentinelOne, and NDR according to each platform’s telemetry scope. SIGMA provides portable coverage for suspicious gateway proxy activity, unauthorized appliance-administration behavior, and RRAS service-host child execution with required backend enrichment. SentinelOne provides both downstream endpoint-behavior coverage and RRAS execution coverage when the RRAS server is protected and RemoteAccess service-process attribution is maintained. AWS, Azure, and GCP provide supporting downstream cloud-activity coverage but do not independently confirm gateway or RRAS exploitation. YARA has no deployable rule because the governing report model is behavioral rather than artifact-driven.

The rule set intentionally avoids CVE-only, exploit-name-only, proof-of-concept-only, source-IP-only, URI-only, WebSocket-only, firmware-version-only, hotfix-only, configuration-change-only, RRAS-service-fault-only, svchost.exe-only, authentication-event-only, endpoint-process-only, cloud-event-only, or network-event-only conclusions.

Detection confidence depends on correlating suspicious appliance-local proxy behavior or validated RRAS service-context execution, unauthorized administrative activity, absent VPN-session or service context, authentication deviations, downstream endpoint execution, abnormal internal communication, and unusual cloud-resource access rather than treating any single event category as proof of compromise.

S27 — Behavior & Log Artifacts

Purpose

This section identifies the primary behavior and log artifacts that support detection, investigation, triage, and validation for suspicious secure remote-access gateway proxy activity; appliance-local service access; unauthorized gateway configuration or hotfix activity; suspicious Windows RRAS service-host execution; gateway-originated authentication without expected context; downstream endpoint execution; abnormal internal expansion; potential credential, session, or TOTP-material misuse; and unusual downstream AWS, Azure, or Google Cloud resource access.

The artifacts below are behavior-led. They should not be treated as proof of a specific vulnerability, exploit, proof-of-concept, appliance or RRAS compromise, credential theft, session-database access, TOTP-seed theft, endpoint compromise, lateral movement, persistence, cloud compromise, or data theft unless they are correlated into a coherent sequence.

Primary Artifact Categories

·        Gateway HTTP, proxy, relay, WebSocket, WAF, and reverse-proxy artifacts.

·        Requested-host, requested-IP, requested-destination, URI, protocol-upgrade, proxy-result, and relay-session artifacts.

·        Gateway administrative, audit, configuration, hotfix, route, service, script, filesystem, and change-management artifacts.

·        Windows RRAS host, RemoteAccess service, service-process attribution, process-creation, process-ancestry, service-fault, and service-restart artifacts.

·        VPN-session, remote-access session, account, workstation, authentication-protocol, destination, logon-result, and identity-service artifacts.

·        SentinelOne network-connection, process-creation, process-ancestry, user, command-line, executable-path, hash, and endpoint artifacts.

·        Internal network-flow, firewall, NDR, destination-role, destination-rarity, destination-diversity, and failed-connection artifacts.

·        Credential, session, authentication-material, token, TOTP, trust-context, and downstream-identity-use artifacts.

·        AWS, Azure, and Google Cloud network, identity, administrative, storage, backup, and workload-access artifacts.

·        Gateway, RRAS host, endpoint, identity, account, session, destination, cloud resource, and event-timestamp correlation artifacts.

Gateway Proxy and Appliance-Local Service Artifacts

Relevant Artifacts

Source IP, destination gateway IP, gateway asset, gateway function, requested host, requested IP, requested destination, requested port, URI path, query parameter, proxy destination, relay destination, WebSocket path, HTTP status, protocol-upgrade result, proxy connection result, relay-session creation, session identifier, loopback address, link-local address, localhost value, appliance-local hostname, appliance-local service, prohibited management destination, approved testing record, vendor-support record, monitoring record, troubleshooting record, and event timestamp.

Useful Log Sources

·        Secure remote-access gateway HTTP logs.

·        Gateway proxy and relay logs.

·        WebSocket logs.

·        WAF logs.

·        Reverse-proxy logs.

·        NDR / Network Behavioral Analytics.

·        Firewall logs.

·        Splunk-ingested gateway telemetry.

·        Elastic-ingested gateway telemetry.

·        QRadar-normalized gateway events.

·        Gateway events normalized for SIGMA translation.

·        SIEM-normalized gateway web telemetry.

Detection Use

These artifacts support detection when an external source reaches a mapped secure remote-access gateway, invokes proxy, relay, or WebSocket functionality, references loopback, link-local, localhost, appliance-local, or prohibited management destinations, and records evidence of successful connection establishment.

Investigation Use

Investigators should determine whether the request aligns with approved testing, vendor support, monitoring, troubleshooting, incident response, or maintenance. They should review source address, requested destination, gateway function, protocol-upgrade state, connection result, URI path, timing, session context, and any subsequent administrative, RRAS, authentication, endpoint, internal-network, or cloud activity.

Non-Coverage Conditions

Internet exposure alone is not sufficient. Vulnerable firmware alone is not sufficient. WebSocket traffic alone is not sufficient. A request to localhost alone is not sufficient. A protocol-upgrade response alone is not sufficient. A known scanner or exploit source alone is not sufficient. These artifacts require a mapped gateway, suspicious proxy or relay behavior, an appliance-local or prohibited destination, and evidence of successful connection establishment.

Gateway Administrative, Configuration, and Hotfix Artifacts

Relevant Artifacts

Gateway name, administrator, source IP, administrative action, hotfix identifier, configuration object, route object, service name, script name, command, object path, file path, target path, temporary path, traversal pattern, configuration result, service result, route result, hotfix-removal result, change-record identifier, approval status, approval start, approval end, vendor-support identity, maintenance window, and event timestamp.

Useful Log Sources

·        Gateway administrative logs.

·        Gateway audit logs.

·        Gateway configuration logs.

·        Gateway hotfix logs.

·        Gateway route and service logs.

·        Gateway system logs.

·        Splunk.

·        Elastic.

·        QRadar.

·        Gateway administrative events normalized for SIGMA translation.

·        Change-management records.

·        Vendor-support records.

·        SIEM-normalized appliance-administration telemetry.

Detection Use

These artifacts support detection when a gateway records hotfix removal, configuration modification, route changes, service changes, script execution, suspicious path activity, temporary script use, prohibited object access, or other high-risk modification outside approved administrative workflows.

Investigation Use

Investigators should determine whether the change aligns with an approved administrator, active change record, maintenance window, vendor-support action, restoration activity, troubleshooting, monitoring, incident response, or patching. They should review the initiating user, source address, action, object, path, command, result, timing, and subsequent gateway, identity, endpoint, internal-network, or cloud behavior.

Non-Coverage Conditions

A gateway configuration change alone is not sufficient. Hotfix removal alone is not sufficient. A route change alone is not sufficient. Service modification alone is not sufficient. Script execution alone is not sufficient. A temporary path alone is not sufficient. These artifacts require high-risk administrative behavior plus absent approved administrator, maintenance-window, vendor-support, or active change-record context.

Windows RRAS Service-Host Execution Artifacts

Relevant Artifacts

RRAS hostname, RRAS server address, external source IP, destination port, network-event timestamp, RemoteAccess service name, active RemoteAccess service process identifier, parent process identifier, parent process name, child process identifier, child process name, process start time, executable path, command line where available, user, process hash where available, service start, service stop, service failure, service restart, recovery action, host restart, approved administration context, approved maintenance window, approved vulnerability-testing context, and correlation interval.

Useful Log Sources

·        Windows process-creation telemetry.

·        Windows service and system logs.

·        Windows Security Event 4688 where enabled.

·        Sysmon process-creation telemetry where deployed.

·        SentinelOne Singularity Data Lake and Deep Visibility.

·        Other EDR process and network telemetry.

·        Splunk-ingested Windows and network telemetry.

·        Elastic Defend or Elastic-ingested Windows telemetry.

·        QRadar-normalized Windows and network events.

·        SIEM or enrichment records maintaining current RemoteAccess service-process attribution.

·        SIGMA-compatible process-creation telemetry after backend service-context enrichment.

·        Firewall or NDR telemetry showing externally sourced activity against the RRAS server.

Detection Use

These artifacts support detection when suspicious externally sourced activity reaches a confirmed RRAS server and is followed within a bounded time window by suspicious child-process execution from a parent process positively attributed to the RemoteAccess service.

Investigation Use

Investigators should validate that the host was actively providing RRAS, confirm the RemoteAccess service process at the time of execution, review parent and child process ancestry, determine whether service restart changed the process mapping, inspect command line where available, review user and executable path, and correlate the execution with preceding external activity and subsequent authentication, endpoint, network, or cloud behavior.

Non-Coverage Conditions

An inbound connection alone is not sufficient. svchost.exe alone is not sufficient. A RemoteAccess service restart or fault alone is not sufficient. A suspicious child process without validated RemoteAccess parent-service attribution is not sufficient to classify the event as RRAS execution. The artifacts establish suspicious Windows service-context execution but do not independently identify the vulnerability used or prove successful exploitation.

Gateway-Originated Authentication Artifacts

Relevant Artifacts

Gateway source IP, gateway asset, destination identity service, destination IP, account, service account, workstation name, authentication protocol, logon type, authentication result, session identifier, assigned client address, VPN-session start, VPN-session end, session status, service window, approved directory destination, approved protocol, approved workstation, approved account, identity-service role, and event timestamp.

Useful Log Sources

·        Domain-controller security logs.

·        LDAP authentication logs.

·        Kerberos logs.

·        NTLM logs.

·        SMB authentication logs.

·        Identity-provider logs.

·        VPN and remote-access session logs.

·        NDR / Network Behavioral Analytics.

·        Splunk.

·        Elastic.

·        QRadar.

·        Firewall logs.

·        SIEM-normalized authentication telemetry.

Detection Use

These artifacts support detection when successful authentication originates from a mapped remote-access gateway, no matching active VPN or remote-access session exists, no approved gateway service workflow applies, and the account, workstation, destination, protocol, or timing deviates from the expected gateway baseline.

Investigation Use

Investigators should validate whether VPN-session telemetry is complete and time-aligned. They should determine whether the account is an approved service identity, whether the destination and protocol are expected, whether the workstation name is consistent, whether the activity falls within an approved service window, and whether preceding RRAS execution or subsequent endpoint, network, administrative, or cloud activity occurred.

Non-Coverage Conditions

Gateway-originated authentication alone is not sufficient. A service-account logon alone is not sufficient. A missing workstation name alone is not sufficient. An unusual protocol alone is not sufficient. The absence of a matching session cannot be treated as malicious when VPN-session telemetry is unavailable or incomplete. These artifacts require absent expected context plus at least one meaningful baseline deviation.

Downstream Endpoint Execution Artifacts

Relevant Artifacts

Gateway source IP, endpoint destination IP, SentinelOne agent name, endpoint name, network-event timestamp, destination port, process-event timestamp, user, parent process, process name, command line, executable path, process hash, process start time, process unique key, process group identifier, approved remote-administration process, approved administrator account, approved administration window, endpoint role, endpoint criticality, and correlation interval.

Useful Log Sources

·        SentinelOne Singularity Data Lake.

·        SentinelOne Deep Visibility telemetry.

·        Endpoint network telemetry.

·        Endpoint process telemetry.

·        EDR telemetry.

·        Splunk-ingested endpoint telemetry.

·        Elastic endpoint telemetry.

·        QRadar-normalized endpoint events.

·        SIEM-normalized endpoint telemetry.

Detection Use

These artifacts support detection when a protected endpoint receives a connection from a mapped remote-access gateway and subsequently launches a suspicious shell, scripting engine, administrative utility, credential-access tool, discovery command, unfamiliar process, suspicious command line, temporary-path executable, or known-malicious file within a bounded time window.

Investigation Use

Investigators should determine whether the process activity aligns with approved remote administration, help-desk activity, software deployment, vulnerability scanning, monitoring, troubleshooting, incident response, or maintenance. They should review the gateway connection, endpoint identity, process ancestry, user, command line, path, hash, time delta, and any subsequent internal or cloud activity.

Non-Coverage Conditions

A gateway connection alone is not sufficient. Shell execution alone is not sufficient. PowerShell or command-shell use alone is not sufficient. An approved administrator account alone is not sufficient for suppression. An approved process alone is not sufficient for suppression. These artifacts require gateway-originated access followed by suspicious execution on the same SentinelOne agent within the configured correlation window.

Internal Expansion and Gateway-Originated Network Artifacts

Relevant Artifacts

Source gateway or RRAS host, source IP, destination host, destination IP, destination port, protocol, destination role, destination criticality, destination first-seen status, destination rarity, approved destination, approved port, approved protocol, unique destination count, connection count, failed connection ratio, connection result, fan-out, service family, identity-service indicator, management-platform indicator, backup-system indicator, virtualization indicator, storage indicator, jump-host indicator, initiating gateway or RRAS event, and event timestamp.

Useful Log Sources

·        NDR / Network Behavioral Analytics.

·        Internal firewall logs.

·        East-west network-flow telemetry.

·        Gateway network logs.

·        RRAS host network telemetry where available.

·        Splunk.

·        Elastic.

·        QRadar.

·        Endpoint network telemetry.

·        Cloud flow logs.

·        Asset inventory.

·        Identity-service telemetry.

·        SIEM-normalized internal network telemetry.

Detection Use

These artifacts support detection when suspicious appliance-local proxy or validated RRAS execution activity is followed by new, rare, unapproved, role-inconsistent, high-volume, high-failure, or high-value internal communication from the same gateway or RRAS host.

Investigation Use

Investigators should determine whether the destination, port, protocol, timing, connection rate, failure pattern, and destination diversity align with expected directory access, monitoring, backup, orchestration, support, testing, incident response, maintenance, or management activity. They should review whether the gateway moved beyond its expected broker role and whether RRAS, endpoint, identity, or cloud evidence aligns.

Non-Coverage Conditions

Internal gateway communication alone is not sufficient. Access to a domain controller alone is not sufficient. Access to a high-value system alone is not sufficient. A new destination alone is not sufficient. A failed connection alone is not sufficient. These artifacts require preceding suspicious gateway or RRAS behavior plus anomalous destination, port, protocol, rarity, destination-diversity, or failed-connection context.

Credential, Session, Token, and TOTP-Material Artifacts

Relevant Artifacts

Gateway session database, session identifier, account, authentication token, cookie, credential record, password record, TOTP seed, multifactor record, authentication event, session creation, session reuse, gateway-originated logon, unusual account use, unusual workstation, identity destination, authentication protocol, downstream endpoint access, cloud identity use, cloud resource access, administrative change, RRAS execution activity, and event timestamp.

Useful Log Sources

·        Gateway session and audit logs.

·        Authentication logs.

·        Identity-provider logs.

·        VPN-session logs.

·        NDR.

·        Splunk.

·        Elastic.

·        QRadar.

·        SentinelOne.

·        Windows RRAS process and service telemetry.

·        AWS activity logs.

·        Azure activity and sign-in logs.

·        Google Cloud Audit Logs.

·        Incident-response evidence.

·        Forensic acquisition.

Detection Use

These artifacts provide supporting evidence when potential credential, session, token, or TOTP material is followed by unexplained authentication, suspicious RRAS or endpoint execution, abnormal internal access, unauthorized gateway changes, or unusual cloud-resource activity.

Investigation Use

Investigators should determine whether session or authentication material was accessed, copied, reused, or used from an unexpected source. They should review authentication timing, gateway or RRAS context, account behavior, session continuity, endpoint activity, internal expansion, cloud-resource use, and incident-response evidence.

Non-Coverage Conditions

A successful login alone is not sufficient. Session creation alone is not sufficient. TOTP use alone is not sufficient. A reused account alone is not sufficient. These artifacts do not directly prove credential theft, session-database access, token theft, or TOTP-seed theft without gateway, memory, file, database, session, authentication, or forensic evidence.

AWS Gateway-Originated Resource Access Artifacts

Relevant Artifacts

Gateway source IP, translated gateway address, destination IP, destination port, protocol, AWS account ID, Region, AWS service, destination resource, resource role, destination first-seen status, activity name, activity result, VPC flow record, Network Firewall event, Elastic Load Balancing event, CloudTrail event, identity context, resource criticality, approved destination, approved protocol, approved port, and event timestamp.

Useful Log Sources

·        VPC Flow Logs.

·        AWS Network Firewall logs.

·        Elastic Load Balancing logs.

·        CloudTrail.

·        Route 53 Resolver logs.

·        GuardDuty.

·        Security Hub.

·        SIEM-normalized AWS telemetry.

Detection Use

These artifacts support detection when a mapped gateway initiates new, rare, unapproved, role-inconsistent, or administratively sensitive access to AWS-hosted identity, management, storage, backup, or workload resources.

Investigation Use

Investigators should determine whether the activity aligns with expected hybrid-cloud access, administration, backup, monitoring, automation, vendor support, incident response, or maintenance. They should review gateway attribution, destination role, service, account, Region, activity result, source context, and corroborating gateway, RRAS, identity, endpoint, or network evidence.

Non-Coverage Conditions

An AWS connection alone is not sufficient. Access to a high-value AWS service alone is not sufficient. CloudTrail activity alone is not sufficient. A new destination alone is not sufficient. These artifacts require unusual or unapproved activity from a mapped gateway plus corroborating context before promotion.

Azure Gateway-Originated Resource Access Artifacts

Relevant Artifacts

Gateway source IP, translated gateway address, destination IP, destination port, protocol, tenant ID, subscription ID, Region, Azure service, destination resource, resource role, destination first-seen status, activity name, activity result, NSG flow record, Azure Firewall event, Application Gateway event, Microsoft Entra ID sign-in, Azure Activity event, approved destination, approved protocol, approved port, and event timestamp.

Useful Log Sources

·        NSG Flow Logs.

·        Azure Firewall logs.

·        Application Gateway logs.

·        Microsoft Entra ID sign-in logs.

·        Azure Activity Logs.

·        Azure Monitor.

·        Defender for Cloud.

·        SIEM-normalized Azure telemetry.

Detection Use

These artifacts support detection when a mapped gateway initiates new, rare, unapproved, role-inconsistent, or administratively sensitive access to Azure-hosted identity, management, storage, backup, or workload resources.

Investigation Use

Investigators should determine whether the activity aligns with expected hybrid-cloud access, administration, backup, monitoring, automation, vendor support, incident response, or maintenance. They should review gateway attribution, tenant, subscription, resource role, service, activity result, source context, and corroborating gateway, RRAS, identity, endpoint, or network evidence.

Non-Coverage Conditions

An Azure connection alone is not sufficient. Microsoft Entra ID activity alone is not sufficient. Azure Activity Log activity alone is not sufficient. Access to a high-value Azure service alone is not sufficient. These artifacts require unusual or unapproved activity from a mapped gateway plus corroborating context before promotion.

GCP Gateway-Originated Resource Access Artifacts

Relevant Artifacts

Gateway source IP, translated gateway address, destination IP, destination port, protocol, organization ID, project ID, Region, Google Cloud service, destination resource, resource role, destination first-seen status, activity name, activity result, VPC flow record, firewall event, Cloud Load Balancing event, Cloud DNS event, Cloud Audit Log event, approved destination, approved protocol, approved port, and event timestamp.

Useful Log Sources

·        VPC Flow Logs.

·        Firewall logs.

·        Cloud Load Balancing logs.

·        Cloud DNS logs.

·        Cloud Audit Logs.

·        Security Command Center.

·        SIEM-normalized Google Cloud telemetry.

Detection Use

These artifacts support detection when a mapped gateway initiates new, rare, unapproved, role-inconsistent, or administratively sensitive access to Google Cloud-hosted identity, management, storage, backup, or workload resources.

Investigation Use

Investigators should determine whether the activity aligns with expected hybrid-cloud access, administration, backup, monitoring, automation, vendor support, incident response, or maintenance. They should review gateway attribution, organization, project, service, destination role, activity result, source context, and corroborating gateway, RRAS, identity, endpoint, or network evidence.

Non-Coverage Conditions

A Google Cloud connection alone is not sufficient. Cloud Audit Log activity alone is not sufficient. Access to a high-value Google Cloud service alone is not sufficient. A new destination alone is not sufficient. These artifacts require unusual or unapproved activity from a mapped gateway plus corroborating context before promotion.

YARA Artifact Disposition

YARA has no deployable primary-rule artifact set for this EXP report.

YARA is not viable as a primary artifact model because the report’s detection surface is behavioral, sequence-based, gateway-telemetry driven, Windows service/process-context driven, proxy and relay activity based, authentication-context based, appliance-administration based, endpoint-correlation based, network-expansion based, and cloud-context based rather than static-file, malware-signature, or artifact-matching based.

YARA may become useful only if a confirmed malicious exploit file, script artifact, web component, loader, dropper, appliance implant, credential-theft utility, session-database collection tool, TOTP-seed harvesting artifact, persistence mechanism, post-exploitation payload, or reusable malware-family artifact is recovered and independently validated.

Final YARA Outcome

No YARA rules survive.

S28 Detection Strategy and SOC Implementation Guidance

Figure 5

Purpose

This section provides implementation guidance for operationalizing the S25 rule set and S26 traceability model across NDR / Network Behavioral Analytics, SentinelOne, Splunk, Elastic, QRadar, SIGMA, YARA, AWS, Azure, GCP, gateway logging, Windows RRAS service and process telemetry, VPN-session telemetry, identity systems, endpoint, EDR, firewall, SIEM, SOAR, and incident-response environments.

The detection strategy is sequence-based. It prioritizes correlated behavior over single-event alerting and avoids treating a single CVE identifier, exploit name, source IP, URI path, WebSocket event, gateway configuration change, hotfix event, RRAS service fault, svchost.exe event, authentication event, endpoint process, internal connection, cloud event, vulnerable-state observation, or static indicator as proof of compromise.

Implementation Strategy

Deploy the detection model in layered stages:

·        Remote-access gateway and RRAS asset inventory, clustered-node mapping, translated addresses, internal interfaces, firmware or software state, exposure state, and business criticality first.

·        Gateway HTTP, proxy, relay, WebSocket, WAF, reverse-proxy, requested-destination, protocol-upgrade, proxy-result, and relay-session telemetry second.

·        Gateway administrative, audit, configuration, hotfix, route, service, script, filesystem, approval, maintenance, and change-management context third.

·        Windows RRAS RemoteAccess service identity, active service-process attribution, process ancestry, process creation, service fault, service restart, and host network context fourth where Windows RRAS is present.

·        VPN-session, remote-access session, account, workstation, authentication-protocol, identity destination, service-window, and logon-result context fifth.

·        SentinelOne network, endpoint, process, ancestry, user, command-line where available, executable-path, hash, endpoint-role, and event-time context sixth.

·        Internal firewall, NDR, flow, destination-role, destination-rarity, destination-diversity, failure-ratio, service-family, and high-value-asset context seventh.

·        AWS, Azure, and Google Cloud network, identity, administrative, storage, backup, and workload-resource context eighth.

·        Alert promotion only after telemetry validation, field-mapping validation, false-positive baselining, exception governance, and triage-playbook alignment.

Telemetry Normalization Requirements

Implementation requires normalized entity and time correlation across gateway web, gateway administration, Windows RRAS service and process, VPN-session, authentication, identity, SentinelOne, endpoint, process, network, firewall, NDR, AWS, Azure, Google Cloud, SOAR, incident-response, and SIEM telemetry.

Minimum Normalization Requirements

·        Gateway name.

·        Canonical gateway ID.

·        Gateway IP address.

·        Gateway translated address.

·        Gateway cluster node.

·        Gateway interface.

·        Gateway role.

·        Gateway exposure state.

·        Gateway firmware or software state.

·        Business criticality.

·        Environment.

·        RRAS host indicator.

·        RRAS hostname.

·        RemoteAccess service name.

·        RemoteAccess service process identifier.

·        RemoteAccess service-process attribution timestamp.

·        Parent process identifier.

·        Parent process name.

·        Child process identifier.

·        Source IP.

·        Destination IP.

·        Destination port.

·        Network protocol.

·        Gateway function.

·        Requested host.

·        Requested IP.

·        Requested destination.

·        Requested port.

·        URI path.

·        HTTP status.

·        Protocol-upgrade result.

·        Proxy connection result.

·        Relay-session state.

·        Gateway session ID.

·        Administrator.

·        Administrative action.

·        Hotfix identifier.

·        Configuration object.

·        Route object.

·        Service name.

·        Script name.

·        Object path.

·        File path.

·        Command where available.

·        Change-record ID.

·        Change status.

·        Approval start.

·        Approval end.

·        Maintenance-window context.

·        Vendor-support context.

·        Authentication account.

·        Workstation name.

·        Authentication protocol.

·        Logon type.

·        Authentication result.

·        Identity-service destination.

·        VPN-session ID.

·        VPN-session status.

·        Assigned client address.

·        VPN-session start.

·        VPN-session end.

·        Approved gateway service context.

·        SentinelOne agent name.

·        Endpoint name.

·        Endpoint role.

·        Endpoint criticality.

·        Process name.

·        Process command line where available.

·        Process image path.

·        Process hash.

·        Process start time.

·        Process unique key.

·        Process group ID.

·        Approved remote-administration context.

·        Internal destination role.

·        Internal destination criticality.

·        Destination first-seen status.

·        Destination rarity.

·        Approved destination.

·        Approved port.

·        Approved protocol.

·        Unique destination count.

·        Failed connection ratio.

·        AWS account, Region, service, resource, and activity.

·        Azure tenant, subscription, Region, service, resource, and activity.

·        GCP organization, project, Region, service, resource, and activity.

·        SOAR case ID.

·        Incident-response case ID.

·        Event timestamp.

·        Event source.

Correlation Requirements

Rules should use bounded correlation windows that reflect the relationship between suspicious gateway proxy behavior, RRAS service-context execution, administrative changes, authentication deviations, downstream endpoint execution, internal expansion, and downstream cloud activity.

Recommended Starting Windows

·        Suspicious external gateway request to successful proxy, relay, or WebSocket establishment within 5 minutes.

·        Suspicious external activity against an RRAS server to suspicious child-process execution from the validated RemoteAccess service process within 30 minutes.

·        Suspicious gateway proxy activity to unauthorized administrative or configuration activity within 2 hours.

·        Suspicious gateway or RRAS activity to unexplained gateway-originated authentication within 2 hours.

·        Gateway-originated endpoint connection to suspicious process execution within 30 minutes.

·        Suspicious gateway or RRAS activity to abnormal internal expansion within 4 hours.

·        Suspicious gateway or RRAS activity to AWS, Azure, or Google Cloud resource access within 8 hours.

·        Continued authentication, endpoint, internal-network, or cloud activity after containment within 24 hours.

These windows should be tightened in high-volume environments and extended only when gateway identity, RRAS host identity, service-process identity, session identity, endpoint identity, account continuity, destination continuity, cloud-resource lineage, SOAR evidence, or incident-response evidence supports continuity.

Alert Promotion Guidance

Do not promote a hunt or correlation search into alert mode until the following conditions are met:

·        Required telemetry is present and normalized.

·        Required field mappings are validated.

·        Gateway and RRAS inventories and address mappings are reliable.

·        RRAS host identification is reliable where RRAS detections are enabled.

·        Current RemoteAccess service-process attribution is reliable.

·        Service-process mappings are refreshed after service or host restart.

·        Requested-destination parsing is reliable.

·        Gateway function and connection-result fields are reliable.

·        Administrative action and object fields are reliable.

·        Change-management and maintenance records are time-bounded.

·        VPN-session telemetry is complete and time-aligned.

·        Authentication source, account, workstation, destination, protocol, result, and session fields are reliable.

·        SentinelOne agent and endpoint mappings are reliable.

·        Network-to-process correlation is tested.

·        RRAS network-to-service-process correlation is tested.

·        Process ancestry, path, hash, user, and available command-line fields are reliable.

·        Internal gateway communication baselines are established.

·        Destination-role and criticality enrichment is validated.

·        Cloud gateway-address mappings are reliable.

·        Cloud destination, service, resource, and activity fields are normalized.

·        Event timing and ordering are reliable.

·        Approved workflow baselines are defined.

·        False-positive sources are reviewed.

·        High-volume expected workflows are suppressed or downgraded.

·        Native query performance is tested where a native implementation has been selected.

·        Cloud detection patterns are converted into and tested in the selected AWS, Azure, and GCP native analytics languages before alerting.

·        Triage guidance is documented.

·        Analyst review criteria are established.

·        Local severity logic is calibrated.

·        Alert-routing ownership is assigned.

False-Positive Control

False-positive control should use approved gateway and RRAS inventories, approved source networks, approved testing records, approved vendor-support activity, approved monitoring activity, approved administrative accounts, active change records, maintenance windows, approved hotfix activity, approved RRAS service recovery, approved gateway service accounts, approved workstation names, approved identity destinations, approved authentication protocols, approved remote-administration processes, approved administrator accounts, approved internal destinations, approved cloud destinations, approved ports, approved protocols, approved automation, and known operational workflows.

Common False-Positive Sources

·        Approved vulnerability testing.

·        Approved gateway or RRAS troubleshooting.

·        Approved vendor support.

·        Approved monitoring.

·        Approved hotfix removal.

·        Approved gateway or RRAS patching.

·        Approved configuration restoration.

·        Approved route changes.

·        Approved service changes.

·        Approved RRAS service restart or recovery.

·        Approved script execution.

·        Approved directory synchronization.

·        Approved service-account activity.

·        Approved VPN and remote-access sessions.

·        Approved help-desk access.

·        Approved remote administration.

·        Approved software deployment.

·        Approved vulnerability scanning.

·        Approved backup activity.

·        Approved orchestration.

·        Approved incident-response activity.

·        Approved forensic collection.

·        Approved hybrid-cloud communication.

·        Approved cloud administration.

·        Approved cloud automation.

·        Emergency maintenance.

·        Break-glass administration.

·        Managed-service activity.

Triage Guidance

Initial triage should determine whether suspicious activity forms a coherent sequence rather than a single-event anomaly.

Triage Questions

·        Did an external source invoke proxy, relay, or WebSocket functionality on a mapped remote-access gateway?

·        Did the request reference loopback, link-local, localhost, appliance-local, or prohibited management destinations?

·        Did the gateway record successful proxy connection, relay-session creation, or WebSocket upgrade?

·        Was the affected Windows host a confirmed RRAS server?

·        Was suspicious externally sourced network activity observed against the RRAS server?

·        Was the parent process positively attributed to the RemoteAccess service at the time of execution?

·        Did suspicious shell, script, administrative, credential-access, discovery, or utility execution originate from that validated service process?

·        Did the RemoteAccess service fault, restart, or recover near the suspicious activity, and is the event unexplained by approved operations?

·        Did an unauthorized hotfix, configuration, route, service, script, object, or filesystem change occur?

·        Was the activity associated with an approved administrator, active change record, maintenance window, or vendor-support action?

·        Did successful authentication originate from the gateway?

·        Was there a matching active VPN or remote-access session?

·        Did the account, workstation, destination, protocol, or timing deviate from the expected gateway baseline?

·        Did the gateway connect to a SentinelOne-protected endpoint?

·        Did suspicious shell, script, administrative, credential-access, or discovery execution follow on that endpoint?

·        Did the same gateway or RRAS host reach new, rare, unapproved, or high-value internal destinations?

·        Did connection diversity, failed-connection ratio, fan-out, or service usage exceed the gateway baseline?

·        Did unusual AWS, Azure, or Google Cloud resource access follow?

·        Can the activity be linked through gateway identity, RRAS host identity, service-process identity, session identity, endpoint identity, account, destination, cloud resource, SOAR case, or incident-response case?

·        Is the activity explained by approved testing, administration, monitoring, directory services, support, backup, deployment, incident response, service recovery, or maintenance?

Escalation Guidance

Escalate when multiple behavior classes align in sequence, especially when suspicious appliance-local proxy behavior or suspicious RRAS service-context execution is followed by unauthorized gateway modification, unexplained authentication, suspicious downstream endpoint execution, abnormal internal expansion, or unusual cloud-resource access.

Higher-Priority Escalation Conditions

·        The gateway or RRAS server is internet-facing.

·        The gateway or RRAS server is production-critical.

·        The gateway provides privileged or broad internal access.

·        The gateway is identity-adjacent.

·        The gateway serves administrators, third parties, or high-value users.

·        Suspicious appliance-local proxy behavior and successful connection establishment align.

·        Suspicious externally sourced RRAS activity and validated RemoteAccess child-process execution align.

·        Suspicious RRAS execution and unexplained authentication or abnormal internal access align.

·        Suspicious gateway activity and unauthorized configuration or hotfix activity align.

·        Suspicious gateway activity and unexplained gateway-originated authentication align.

·        Gateway-originated endpoint access and suspicious process execution align.

·        Suspicious gateway activity and abnormal internal expansion align.

·        The gateway reaches identity systems, management platforms, backup infrastructure, virtualization systems, storage systems, or jump hosts.

·        AWS, Azure, or Google Cloud activity involves identity, management, storage, backup, secrets, administrative resources, or sensitive workloads.

·        Multiple systems independently show aligned behavior.

·        Activity continues after containment or credential reset.

Deployment Guardrails

Do not deploy these detections as fully automated blocking or containment logic without local validation.

Do not treat a single CVE identifier, exploit name, source IP, URI path, WebSocket event, localhost request, configuration change, hotfix event, RRAS service fault, service restart, svchost.exe event, authentication event, endpoint process, internal connection, cloud event, vulnerable-state observation, or static indicator as proof of compromise.

Do not attribute gateway-only, RRAS-service-only, authentication-only, endpoint-only, process-only, network-only, cloud-only, or exposure-only anomalies to successful gateway compromise, RRAS exploitation, credential theft, session theft, TOTP-seed theft, endpoint compromise, lateral movement, persistence, data theft, or cloud compromise without reliable gateway or RRAS host, service, process, session, identity, endpoint, destination, resource, and sequence correlation.

Do not enable high-confidence alerting until platform-specific schemas, index names, sourcetypes, DSM fields, custom properties, ECS mappings, SentinelOne PowerQuery fields, RRAS service-process fields, gateway fields, authentication fields, VPN-session fields, network mappings, cloud fields, enrichment sources, exception lists, false-positive baselines, query performance, triage readiness, and escalation criteria have been validated.

Do not treat the current AWS, Azure, or GCP detection patterns as production-native rules until each has been translated into the selected native cloud analytics language, mapped to the local cloud schema, and validated against representative benign and suspicious telemetry.

S29 — Detection Coverage Summary

Coverage Summary

The S25 detection set provides broad behavior-led coverage for suspicious gateway proxy access to appliance-local services, unauthorized gateway configuration or hotfix activity, suspicious Windows RRAS service-host execution, gateway-originated authentication without expected context, suspicious endpoint execution following gateway-originated access, abnormal internal expansion, potential credential or session misuse, and unusual downstream AWS, Azure, and Google Cloud resource access.

Coverage is strongest when gateway web, gateway administrative, Windows RRAS service and process, VPN-session, authentication, identity, endpoint, process, firewall, NDR, cloud-audit, network-flow, asset-inventory, and SIEM telemetry are normalized and correlated into bounded sequences.

The report’s detection model intentionally avoids CVE-only matching, exploit-name-only matching, source-IP-only matching, URI-only matching, WebSocket-only conclusions, localhost-request-only conclusions, configuration-change-only conclusions, hotfix-only conclusions, RRAS-service-fault-only conclusions, svchost.exe-only conclusions, authentication-event-only conclusions, endpoint-process-only conclusions, cloud-event-only conclusions, network-event-only conclusions, vulnerable-state-only conclusions, and other single-event determinations.

Strong Coverage Areas

·        Suspicious external gateway proxy, relay, or WebSocket activity directed toward appliance-local services.

·        Successful proxy connection, relay-session creation, or WebSocket upgrade involving loopback, link-local, localhost, or prohibited destinations.

·        Unauthorized gateway configuration, hotfix, route, service, script, object, or filesystem activity.

·        Suspicious child-process execution from a process positively attributed to the Windows RemoteAccess service.

·        Suspicious externally sourced activity against an RRAS server followed by validated service-context execution.

·        Gateway-originated authentication without expected VPN-session or service context.

·        Account, workstation, destination, protocol, or service-window deviations associated with gateway-originated authentication.

·        Suspicious endpoint execution following a gateway-originated connection.

·        Abnormal internal communication from the gateway or RRAS host following suspicious gateway or RRAS behavior.

·        New, rare, unapproved, or high-value internal destinations reached from the gateway.

·        Unusual AWS resource access originating from a mapped gateway.

·        Unusual Azure resource access originating from a mapped gateway.

·        Unusual Google Cloud resource access originating from a mapped gateway.

Moderate Coverage Areas

·        Appliance-local service access where requested-destination parsing is incomplete.

·        Unauthorized gateway activity where command, process, path, or object telemetry is partial.

·        RRAS execution correlation where service-process attribution, network telemetry, or process ancestry is incomplete.

·        RRAS execution where command-line telemetry is unavailable but process ancestry and executable context remain observable.

·        Authentication correlation where VPN-session data is delayed or incomplete.

·        SentinelOne correlation where endpoint identity or event ordering is inconsistent.

·        Internal expansion where NAT, shared addressing, proxies, or limited east-west visibility obscure source attribution.

·        Potential credential, session, token, or TOTP misuse where direct theft telemetry is unavailable.

·        SIGMA portability across SIEM backends.

·        AWS, Azure, and GCP detection patterns pending conversion into selected native cloud analytics languages.

·        Cloud detection where gateway-address, destination-resource, identity, account, subscription, project, source-IP, or user-context mapping is partial.

Limited Coverage Areas

·        Exploitation that produces no observable gateway proxy, administrative, RRAS execution, authentication, endpoint, network, or cloud behavior.

·        Appliance-local activity that remains entirely inside a closed gateway and is not logged.

·        Memory-only RRAS exploitation that produces no observable child process or downstream behavior.

·        Credential, session, token, or TOTP theft without observable downstream use.

·        Attackers using approved accounts, expected sessions, trusted processes, approved destinations, normal protocols, or normal service windows.

·        Low-volume internal access to already approved destinations.

·        Gateway modifications that do not generate administrative or audit events.

·        Endpoint or RRAS execution that blends into approved administration.

·        Cloud activity that follows normal hybrid-cloud communication patterns.

·        Environments without gateway destination logging, RRAS service-process attribution, VPN-session telemetry, endpoint process telemetry, east-west visibility, or cloud activity logging.

Non-Covered Areas

The S25 rule set does not directly prove:

·        The specific vulnerability used.

·        The specific server-side request forgery, memory-corruption, code-injection, or other exploitation mechanism.

·        Appliance-local command execution on a closed gateway where runtime telemetry is unavailable.

·        That observed RRAS child-process execution was definitely caused by exploitation.

·        Successful gateway or RRAS exploitation solely from a single event.

·        Session-database access.

·        Credential theft.

·        Token theft.

·        TOTP-seed theft.

·        Endpoint compromise.

·        Successful lateral movement.

·        Persistence.

·        AWS compromise.

·        Azure compromise.

·        Google Cloud compromise.

·        Data theft.

·        Adversary attribution.

·        Campaign attribution.

These outcomes require investigation, corroborating telemetry, and incident-specific validation.

System Coverage Summary

NDR / Network Behavioral Analytics

NDR provides primary network-behavior coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Gateway-Originated Authentication Without Expected Context, and Suspicious Internal Access Following Gateway Exploitation Activity.

NDR also provides supporting network context for RRAS exploitation sequences but does not independently validate RemoteAccess service-process attribution or Windows child-process execution.

NDR does not independently prove appliance-local command execution, gateway configuration manipulation, credential theft, session-database access, TOTP-seed theft, endpoint compromise, or cloud compromise without gateway, RRAS, identity, endpoint, cloud, or incident-response context.

SentinelOne

SentinelOne provides primary downstream endpoint coverage through Suspicious Endpoint Execution Following Remote-Access Gateway Connection and RRAS execution coverage through Suspicious RRAS Service-Host Execution Following External Network Activity.

SentinelOne uses network and process telemetry to correlate externally sourced activity against an RRAS server with suspicious execution from a validated RemoteAccess service process and separately correlates gateway-originated network events with suspicious process creation on downstream protected endpoints.

SentinelOne does not treat svchost.exe alone as RRAS execution and cannot independently determine which vulnerability caused observed service-context execution.

Splunk

Splunk provides strong SIEM correlation coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Unauthorized Gateway Configuration or Hotfix Activity, Gateway-Originated Authentication Without Expected Context, and Suspicious RRAS Service-Host Execution Following External Network Activity.

Splunk production value depends on normalized gateway web, administrative, configuration, RRAS service-process, VPN-session, authentication, identity, asset, lookup, approval, endpoint, network, and cloud fields with reliable correlation and exceptions.

Elastic

Elastic provides strong KQL and EQL-aligned coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Unauthorized Gateway Configuration or Hotfix Activity, Gateway-Originated Authentication Without Expected Context, and Suspicious RRAS Service-Host Execution Following External Network Activity.

Elastic production value depends on ECS or local-field normalization, gateway and RRAS enrichment, validated RemoteAccess service context, approval context, VPN-session availability, identity mappings, sequence logic, and exception quality.

QRadar

QRadar provides strong SIEM correlation and offense-generation coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Unauthorized Gateway Configuration or Hotfix Activity, Gateway-Originated Authentication Without Expected Context, and Suspicious RRAS Service-Host Execution Following External Network Activity.

QRadar production value depends on validated DSM parsing, custom properties, gateway and RRAS reference sets, RemoteAccess service-process mappings, building blocks, event ordering, approval context, gateway mapping, session availability, and identity-service normalization.

SIGMA

SIGMA provides portable event-rule template coverage through Suspicious Gateway Proxy Access to Appliance-Local Services, Unauthorized Gateway Configuration or Hotfix Activity, and Suspicious RRAS Service-Host Child Process Execution.

SIGMA production value depends on backend translation quality, field mappings, gateway and RRAS filtering, RemoteAccess service enrichment, destination enrichment, approval exclusions, maintenance-window validation, and SIEM-native network-to-process correlation.

YARA

YARA has zero deployable rules for this EXP report because no stable malicious exploit file, script family, loader, dropper, appliance implant, credential-theft utility, session-database collection tool, TOTP-seed harvesting artifact, persistence mechanism, post-exploitation payload, or reusable malware family is available.

AWS

AWS provides a supporting downstream cloud detection pattern through Suspicious AWS Resource Access Originating From a Remote-Access Gateway.

AWS production deployment requires conversion of the current pattern into the selected native AWS analytics language or rule-construction mode, followed by local schema mapping and validation.

AWS coverage depends on reliable gateway-address mapping, VPC Flow Logs, AWS Network Firewall logs, Elastic Load Balancing logs, CloudTrail, resource-role enrichment, approved communication baselines, and corroborating gateway, RRAS, identity, endpoint, or incident-response evidence.

Azure

Azure provides a supporting downstream cloud detection pattern through Suspicious Azure Resource Access Originating From a Remote-Access Gateway.

Azure production deployment requires conversion of the current pattern into the selected native Azure analytics language or rule-construction mode, followed by local schema mapping and validation.

Azure coverage depends on reliable gateway-address mapping, NSG Flow Logs, Azure Firewall logs, Application Gateway logs, Microsoft Entra ID sign-in logs, Azure Activity Logs, resource-role enrichment, approved communication baselines, and corroborating gateway, RRAS, identity, endpoint, or incident-response evidence.

GCP

GCP provides a supporting downstream cloud detection pattern through Suspicious GCP Resource Access Originating From a Remote-Access Gateway.

GCP production deployment requires conversion of the current pattern into the selected native Google Cloud analytics language or rule-construction mode, followed by local schema mapping and validation.

GCP coverage depends on reliable gateway-address mapping, VPC Flow Logs, firewall logs, Cloud Load Balancing logs, Cloud DNS logs, Cloud Audit Logs, resource-role enrichment, approved communication baselines, and corroborating gateway, RRAS, identity, endpoint, or incident-response evidence.

Coverage Conclusion

The detection set provides strong practical coverage for observable enterprise behavior associated with suspicious gateway proxy activity, unauthorized gateway modification, suspicious Windows RRAS service-context execution, unexplained gateway-originated authentication, suspicious downstream endpoint execution, abnormal internal expansion, and unusual cloud-resource access.

It is strongest when multiple telemetry classes align in sequence and weakest where exploitation produces no observable gateway, RRAS process, administrative, authentication, endpoint, network, or cloud behavior.

S30 — Intelligence Maturity Assessment

Maturity Assessment Summary

The intelligence maturity level for this report is high for behavior-led detection strategy and moderate for direct exploitation confirmation.

The detection model is mature because it focuses on durable behavioral relationships: suspicious proxy, relay, or WebSocket access to appliance-local services; unauthorized gateway modification; suspicious Windows RRAS service-context execution; unexplained gateway-originated authentication; suspicious downstream endpoint execution; abnormal internal expansion; and unusual downstream cloud-resource access.

Direct exploitation confirmation remains limited because enterprise telemetry may not expose the underlying server-side request forgery, memory-corruption, code-injection, or other exploit mechanism directly. Closed gateway appliances may also lack runtime visibility into appliance-local command execution, session-database access, credential extraction, token theft, TOTP-seed theft, or other technical exploitation behavior. Windows RRAS provides stronger process and service visibility where RemoteAccess service-process attribution and endpoint telemetry are available, but suspicious service-context execution still does not independently identify the vulnerability used.

Behavioral Intelligence Maturity

Behavioral maturity is high.

The report identifies repeatable gateway and post-compromise behavior that can be detected across gateway HTTP, proxy, relay, WebSocket, administrative, configuration, Windows RRAS service and process, identity, VPN-session, SentinelOne, endpoint, firewall, NDR, SIEM, AWS, Azure, and Google Cloud platforms.

The behaviors are durable across CVE identifiers, exploit names, proof-of-concept repositories, source IPs, URI paths, WebSocket paths, appliance versions, RRAS vulnerability identifiers, hotfix identifiers, attacker tooling, cloud providers, source infrastructure, and campaign branding.

Strong Behavioral Anchors

·        External proxy, relay, or WebSocket access to appliance-local services.

·        Loopback, link-local, localhost, or prohibited management destination targeting.

·        Successful proxy connection, relay-session creation, or protocol upgrade.

·        Unauthorized gateway configuration, hotfix, route, service, script, object, or filesystem activity.

·        Suspicious child-process execution from a process positively attributed to the Windows RemoteAccess service.

·        Externally sourced RRAS activity followed by validated service-context execution.

·        Gateway-originated authentication without expected session or service context.

·        Account, workstation, destination, protocol, or timing deviation.

·        Gateway-originated endpoint access followed by suspicious process execution.

·        Abnormal internal expansion from the gateway or RRAS host.

·        Access to identity, management, backup, virtualization, storage, or jump-host infrastructure.

·        Unusual AWS, Azure, or Google Cloud resource access originating from the gateway.

Telemetry Maturity

Telemetry maturity is moderate to high.

Gateway web, gateway administrative, Windows RRAS service and process, VPN-session, identity, authentication, SentinelOne, endpoint, firewall, NDR, cloud-audit, network-flow, and asset-inventory telemetry provide strong coverage where gateway, RRAS host, RemoteAccess service, session, account, endpoint, process, destination, cloud resource, and timestamp fields are available and normalized.

RRAS telemetry maturity is strongest where confirmed RRAS inventory, current RemoteAccess service-process attribution, process ancestry, network activity, executable path, user context, service faults or restarts, and available command-line telemetry can be correlated by host and time.

Telemetry maturity decreases when requested-destination fields are unavailable, appliance-local traffic is not logged, administrative actions are incomplete, RRAS service-process attribution is missing or stale, process ancestry is incomplete, VPN-session telemetry is delayed, endpoint correlation is inconsistent, east-west visibility is weak, gateway addresses are translated or shared, cloud identity mappings are incomplete, or approved workflow baselines are weak.

Cloud and Hybrid-Access Maturity

Cloud and hybrid-access maturity is moderate.

AWS, Azure, and Google Cloud provide useful downstream visibility when cloud telemetry can be joined to suspected gateway or RRAS compromise through gateway address, translated address, destination resource, account, tenant, subscription, project, Region, service, source IP, identity, or time-window lineage.

Cloud platforms do not independently prove gateway or RRAS exploitation. Their strongest value comes from correlating unusual gateway-originated communication with identity, management, storage, backup, workload, or administrative-resource access.

Maturity increases when VPC Flow Logs, AWS Network Firewall logs, CloudTrail, NSG Flow Logs, Azure Firewall logs, Microsoft Entra ID sign-in logs, Azure Activity Logs, Google Cloud VPC Flow Logs, Cloud Audit Logs, destination-role enrichment, and gateway-address mappings are normalized and validated.

Production maturity for AWS, Azure, and GCP depends on mapping the native Athena SQL, Microsoft Sentinel KQL, and BigQuery GoogleSQL patterns to local schemas, telemetry sources, approved baselines, and environment-specific values.

Adversary-Resilience Maturity

Adversary-resilience maturity is high for behavior-led detection and moderate for high-confidence exploit attribution.

The detection model is resilient because it avoids brittle indicators and focuses on behavior an adversary may produce when abusing a secure remote-access gateway to reach appliance-local services, exploiting Windows RRAS into suspicious service-context execution, modifying gateway state, misusing identity context, executing on downstream endpoints, expanding internally, or accessing cloud resources.

The model is less resilient when adversaries use approved accounts, expected sessions, trusted processes, normal protocols, approved destinations, expected peer relationships, low-and-slow timing, or existing administrative workflows. It is also less resilient when adversaries avoid gateway modifications, observable RRAS child-process execution, suspicious endpoint execution, internal expansion, and downstream cloud activity.

Memory-only RRAS exploitation that does not produce observable child-process, service, authentication, or network behavior remains a material visibility limitation.

Operationalization Maturity

Operationalization maturity is moderate.

The S25 rules are implementation-ready detection patterns. NDR uses vendor-neutral behavioral logic because no specific NDR product is named. SentinelOne, Splunk, Elastic, QRadar, and SIGMA provide platform-aligned implementations for the observable behaviors in scope, including the new Windows RRAS service-context execution layer. AWS, Azure, and GCP require conversion into the selected native cloud analytics language before production implementation.

RRAS operationalization additionally requires confirmed RRAS asset inventory, reliable RemoteAccess service-process attribution, service-process refresh after restart, parent-process and child-process visibility, externally sourced network context, and approved administrative baselines.

Production deployment requires local validation of schemas, index names, sourcetypes, DSM fields, custom properties, ECS mappings, SentinelOne PowerQuery fields, RRAS service-process fields, gateway fields, VPN-session fields, authentication fields, network fields, cloud fields, asset mappings, enrichment, exceptions, false-positive baselines, query performance, triage logic, and alert-routing decisions.

Operational maturity increases when detection owners validate each platform’s implementation mode, confirm telemetry quality, baseline approved testing, vendor support, administration, RRAS service recovery, directory services, remote access, endpoint management, monitoring, backup, cloud automation, incident response, and maintenance, and test correlation logic using realistic benign and suspicious event data.

Attribution Maturity

Attribution maturity is low to moderate.

The rule set supports detection of behavior consistent with suspicious gateway proxy activity, unauthorized appliance modification, suspicious RRAS service-context execution, unexplained authentication, downstream endpoint execution, internal expansion, and cloud-resource access.

It should not be used by itself to attribute activity to a specific adversary, campaign, exploit developer, malware family, infrastructure provider, named threat group, or specific RRAS vulnerability without external evidence and incident-specific validation.

Attribution requires corroborating evidence such as exploitation timeline, gateway or RRAS logs, administrative records, service-process lineage, session evidence, process lineage, recovered artifacts, source infrastructure, credential use, network destinations, cloud activity, victimology, actor tradecraft, and threat-intelligence reporting.

Maturity Limitations

Primary Maturity Limitations

·        Limited direct visibility into successful exploitation.

·        Limited direct visibility into server-side request forgery, memory-corruption, code-injection, or other exploit mechanics.

·        Limited visibility into appliance-local command execution on closed or managed gateways.

·        Variable visibility into RRAS service-context execution when RemoteAccess attribution is incomplete.

·        Memory-only RRAS exploitation may produce no observable child process.

·        Variable RRAS service-process attribution after service or host restart.

·        Limited visibility into session-database access.

·        Limited visibility into credential, token, or TOTP-seed theft.

·        Variable gateway requested-destination telemetry.

·        Variable gateway administrative and audit telemetry.

·        Variable VPN-session completeness.

·        Variable authentication-source and session mapping.

·        Variable SentinelOne endpoint and process correlation.

·        Variable east-west network visibility.

·        Variable gateway-address attribution.

·        Variable internal destination-role enrichment.

·        Variable cloud gateway-address mapping.

·        Variable cloud activity logging.

·        Variable approved workflow baselines.

·        High false-positive potential when detections are deployed without local tuning.

Maturity Improvement Priorities

Priority Improvements

·        Improve gateway HTTP, proxy, relay, WebSocket, WAF, and reverse-proxy logging.

·        Improve requested-host, requested-IP, requested-destination, URI, protocol-upgrade, proxy-result, and relay-session normalization.

·        Improve gateway administrative, audit, configuration, hotfix, route, service, script, object, path, and command logging.

·        Improve confirmed Windows RRAS asset identification.

·        Maintain current RemoteAccess service-process attribution on RRAS servers.

·        Refresh RemoteAccess service-process mappings following service or host restart.

·        Improve RRAS process-creation, process-ancestry, service-fault, service-restart, and endpoint-network telemetry.

·        Improve available process command-line collection where operationally appropriate.

·        Improve active change-record, maintenance-window, vendor-support, and approved-administrator context.

·        Improve VPN-session completeness and time alignment.

·        Improve gateway service-account, workstation, identity-destination, protocol, and service-window baselines.

·        Improve SentinelOne agent, network-event, process-event, user, ancestry, command-line where available, path, and hash telemetry.

·        Improve PowerQuery validation and scheduled-detection support.

·        Improve gateway-to-endpoint, RRAS-network-to-process, gateway-to-identity, and gateway-to-destination correlation.

·        Improve internal firewall, NDR, destination-rarity, destination-diversity, failure-ratio, and asset-role enrichment.

·        Validate the Amazon Athena SQL pattern against the local AWS schema and representative telemetry.

·        Validate the Microsoft Sentinel KQL pattern against the local Azure schema and representative telemetry.

·        Validate the Google BigQuery GoogleSQL pattern against the local Google Cloud schema and representative telemetry.

·        Improve AWS gateway-address and resource-role mapping.

·        Improve Azure gateway-address and resource-role mapping.

·        Improve Google Cloud gateway-address and resource-role mapping.

·        Enable relevant AWS, Azure, and Google Cloud network and activity logging.

·        Build approved workflow baselines for testing, vendor support, gateway administration, RRAS service administration and recovery, directory services, remote access, endpoint management, backup, monitoring, cloud automation, incident response, and maintenance.

·        Test native detection logic against realistic benign and suspicious sequences before alert promotion.

Final Intelligence Maturity Assessment

The report’s intelligence maturity is strong for behavior-led detection engineering, strong for executive risk framing, moderate to strong for telemetry-driven operational detection, moderate to strong for gateway, RRAS, identity, endpoint, SIEM, and network correlation, moderate for downstream AWS, Azure, and Google Cloud activity correlation, and low to moderate for direct exploitation or attribution confirmation.

The S25 through S30 detection model is best used as an implementation-ready threat-to-detection framework that identifies suspicious appliance-local proxy behavior, unauthorized gateway modification, suspicious Windows RRAS service-context execution, unexplained gateway-originated authentication, suspicious endpoint execution, abnormal internal expansion, and unusual downstream cloud-resource access.

It should not be used as a standalone proof model for a specific vulnerability, successful gateway or RRAS exploitation, closed-appliance command execution, credential theft, session theft, TOTP-seed theft, endpoint compromise, successful lateral movement, persistence, data theft, or cloud compromise without corroborating telemetry and incident-specific validation.

S31 — Telemetry Dependencies

Secure remote-access gateway compromise and identity pivoting require telemetry capable of proving whether suspicious external interaction remained limited to scanning, failed exploitation, authorized testing, vendor support, or routine administration, or progressed into appliance-local service access, unauthorized gateway control, authentication-material exposure, gateway-originated authentication, endpoint execution, internal expansion, or cloud-resource access. The central dependency is the ability to correlate gateway inventory, vulnerable-state history, web and proxy activity, appliance audit and configuration records, VPN-session context, identity and directory-service telemetry, downstream endpoint activity, internal network behavior, cloud audit data, change-control records, incident-response evidence, and business-owner context into one gateway-to-identity-to-impact investigation model.

Gateway Asset, Vulnerability, and Trust Context

·        Asset telemetry must identify secure remote-access gateways, VPN concentrators, application-access gateways, secure access brokers, virtual appliances, clustered nodes, high-availability pairs, cloud-hosted gateways, disaster-recovery appliances, translated addresses, internal interfaces, and management interfaces.

·        Vulnerability telemetry must identify vendor, product, appliance model, firmware version, hotfix state, vulnerable-state history, patch date, reboot date, replacement date, configuration-restoration status, and remediation status at the time suspicious activity occurred.

·        Required fields include gateway name, canonical asset identifier, external IP address, internal IP address, translated address, cluster membership, node identifier, site, region, business owner, platform owner, internet exposure, remote-user population, privileged-access role, identity-service integration, internal destinations, cloud connectivity, business criticality, and recovery priority.

·        This telemetry is required to determine whether suspicious activity affected an appliance capable of brokering trusted access to identity systems, administrative networks, production applications, cloud resources, backup infrastructure, virtualization systems, storage systems, or regulated services.

·        Current patch or firmware status must not replace historical vulnerable-state validation because gateways may have been patched, rebooted, rebuilt, replaced, restored, or failed over after suspicious activity.

Gateway Web, Proxy, Relay, and Session Telemetry

·        Gateway web telemetry must capture HTTP method, URI path, query values, requested host, requested IP, requested destination, requested port, source IP, forwarded source IP, user agent, response status, protocol-upgrade result, proxy result, relay-session state, VPN session identifier, appliance identity, and timestamp where available.

·        Required visibility includes proxy, relay, WebSocket, tunneling, API, administrative, diagnostic, support, update, and management functions exposed by the gateway.

·        This telemetry is required to determine whether external requests referenced loopback, localhost, link-local, appliance-local, internal, encoded, malformed, or prohibited management destinations and whether the gateway established a successful connection.

·        Session telemetry must capture VPN session creation, authentication, assigned address, user, device, gateway node, source address, connection start, connection end, session status, access policy, target application, and termination reason where available.

·        Web and session telemetry must be interpreted against approved vulnerability testing, vendor support, monitoring, health checks, remote-access use, troubleshooting, and incident-response activity.

Appliance Audit, Administrative, Configuration, and Control-Plane Telemetry

·        Appliance telemetry must capture administrator logons, administrative actions, configuration changes, hotfix installation or removal, route changes, service changes, account changes, access-rule changes, certificate changes, script execution, file activity, export activity, backup activity, restoration activity, and appliance reboots.

·        Required fields include appliance identifier, administrator, source address, action, object, path, command, previous value, new value, result, session identifier, timestamp, change record, maintenance context, and support context where available.

·        This telemetry is required to determine whether suspicious external interaction progressed into unauthorized gateway control, configuration manipulation, service modification, route changes, account creation, access-rule changes, or forensic cleanup.

·        Known-good configuration baselines must be retained for high-value gateways and compared with current and historical configurations during investigation.

·        Administrative activity must be interpreted against approved maintenance, hotfix deployment, support access, backup, restoration, failover, disaster recovery, testing, and incident-response workflows.

Credential, Session, Token, Certificate, and TOTP Telemetry

·        Authentication-resource telemetry should capture access to active-session data, session databases, cookies, tokens, administrator credentials, directory-integration credentials, LDAP credentials, service-account material, certificates, VPN context, multifactor records, and TOTP seed material where the platform exposes it.

·        Required fields include appliance identifier, resource type, object, user, process or service where available, access action, export or copy action, destination, result, timestamp, administrative context, and approval status.

·        This telemetry is required to determine whether successful gateway compromise exposed authentication material capable of supporting identity impersonation, session reuse, valid-account abuse, or alternate authentication material use.

·        Where direct resource-access telemetry is unavailable, compensating evidence must come from configuration exports, administrative events, session anomalies, account use, downstream authentication, credential rotation records, and incident-response findings.

·        Authentication-material exposure must be interpreted against approved backup, migration, certificate renewal, credential rotation, support, restoration, and forensic collection activity.

Identity, Directory-Service, and Authentication Telemetry

·        Identity telemetry must capture NTLM, Kerberos, LDAP, LDAPS, SMB, certificate-based, token-based, application, and cloud authentication involving gateway addresses, gateway-integrated accounts, remote users, service accounts, and downstream systems.

·        Required fields include source IP, source asset, destination IP, destination asset, account, account type, workstation name, authentication protocol, logon type, result, session identifier, client address, user agent, timestamp, and identity-provider context.

·        This telemetry is required to determine whether the gateway or gateway-associated identities authenticated to internal resources without a corresponding authorized VPN session or approved service workflow.

·        Gateway-to-service-account mapping, gateway-to-domain-controller mapping, expected workstation names, approved protocols, approved destinations, service windows, and directory-integration behavior must be maintained.

·        Identity telemetry must distinguish failed-to-success sequences, new destinations, unfamiliar workstation names, unusual protocols, activity outside service windows, and account use inconsistent with the gateway’s approved role.

Endpoint and Downstream Process Telemetry

·        Endpoint telemetry must capture network connections from gateway addresses followed by process creation, process ancestry, command line, executable path, user, logon session, file activity, credential-access behavior, discovery activity, remote-management activity, persistence, and timestamp.

·        Required visibility includes shells, scripting engines, remote-management utilities, administrative tools, credential-access tools, discovery commands, service creation, scheduled activity, and execution from temporary or user-controlled paths.

·        This telemetry is required to determine whether gateway-originated access resulted in suspicious execution on protected endpoints.

·        Endpoint evidence must be correlated by destination asset, gateway source, account, session, process, and bounded time window.

·        Gateway-originated network access alone must not be treated as endpoint compromise without suspicious process, user, file, service, or persistence activity.

Network, Firewall, DNS, Proxy, and NDR Telemetry

·        Network telemetry must capture inbound activity to the gateway, gateway-originated communication, internal authentication traffic, access to management services, destination fan-out, unusual ports, unusual protocols, repeated failures, rare destinations, cloud access, and external callbacks.

·        Required fields include source asset, source IP, destination asset, destination IP, destination port, protocol, action, session identifier, bytes transferred, duration, first-seen status, destination role, timestamp, and gateway attribution.

·        This telemetry is required to connect suspicious external requests, appliance-local behavior, internal authentication, endpoint access, internal expansion, and cloud communication into one investigation timeline.

·        Gateway-specific approved destination, port, protocol, identity-service, management-service, backup-service, monitoring-service, and cloud-service baselines must be maintained.

·        Network telemetry must not be used as standalone proof of successful gateway exploitation because it may lack the request, administrative, session, account, and appliance context needed for attribution.

Cloud Identity and Control-Plane Telemetry

·        Cloud telemetry must capture sign-ins, token use, role activity, API actions, storage access, backup access, management-plane activity, remote commands, identity changes, access-policy changes, secret retrieval, resource creation, and security-control changes involving gateway addresses or compromised accounts.

·        Required fields include cloud provider, account, subscription, project, region, principal, role, service account, source IP, user agent, authentication method, API action, target resource, result, timestamp, and approved automation context.

·        This telemetry is required to determine whether gateway-associated accounts, sessions, tokens, or trusted access paths were used against AWS, Azure, or Google Cloud resources.

·        Cloud activity must be correlated to the suspected gateway compromise by source address, account, session, token, user agent, resource, destination, or bounded time window.

·        Cloud-control-plane activity alone cannot prove gateway compromise and should be treated as downstream or supporting evidence.

Change-Control, Incident Response, Remediation, and Business Context

·        Change-control telemetry must capture approved gateway administration, firmware updates, hotfix activity, configuration changes, route changes, service changes, certificate renewal, backup, restoration, vendor support, penetration testing, monitoring, failover, disaster recovery, and incident-response collection.

·        Incident-response records must capture affected gateway, node, external source, request, local destination, administrator, account, session, identity system, endpoint, internal destination, cloud resource, containment action, credential rotation, TOTP reset, rebuild decision, evidence source, timestamp, validation status, and closure rationale.

·        Business context must identify gateway owner, network owner, identity owner, cloud owner, application owner, remote-access population, privileged-user population, third-party dependency, regulated-system dependency, customer impact, partner impact, business criticality, and recovery priority.

·        This telemetry is required to determine whether suspicious behavior was attacker-driven, administrator-driven, support-driven, monitoring-related, testing-related, maintenance-related, recovery-related, or incident-response-related.

·        Remediation must not be treated as complete until vulnerable-state resolution, appliance integrity, authentication-material exposure, session state, service-account use, endpoint activity, internal expansion, cloud activity, and post-remediation behavior have been explicitly validated.

S32 — Detection Limitations

Detection of secure remote-access gateway compromise and identity pivoting is limited by whether the organization can reconstruct the relationship between suspicious external interaction, proxy or relay behavior, appliance-local service access, unauthorized gateway control, authentication-material exposure, gateway-originated authentication, endpoint execution, internal expansion, cloud activity, and remediation evidence. Environments that rely only on vulnerable firmware, CVE references, KEV status, public proof-of-concept strings, source IP addresses, isolated WebSocket activity, configuration events, authentication anomalies, or cloud sign-ins will not have enough evidence for high-confidence compromise or impact determination.

Primary Limitations

·        Missing gateway inventory may prevent identification of affected appliances, clustered nodes, virtual gateways, translated addresses, internal interfaces, disaster-recovery systems, and connected trust relationships.

·        Missing historical firmware, hotfix, configuration, reboot, failover, and patch data may prevent validation of the gateway’s vulnerable state when suspicious activity occurred.

·        Missing requested-host, requested-IP, requested-destination, decoded-value, protocol-upgrade, relay-result, or proxy-result fields may prevent distinction between probing and successful appliance-local access.

·        Missing administrative and configuration telemetry may prevent review of unauthorized command execution, hotfix removal, route changes, service changes, account changes, access-rule changes, or filesystem activity.

·        Missing session-resource telemetry may prevent assessment of active-session data, cookies, authentication tokens, certificates, VPN context, or TOTP seed exposure.

·        Missing VPN-session records may prevent comparison of gateway-originated authentication with authorized remote-user activity.

·        Missing or unreliable gateway-to-service-account mapping may prevent distinction between normal directory integration and identity abuse.

·        Missing workstation-name, client-address, session-identifier, protocol, or destination fields may prevent reliable authentication correlation.

·        Missing endpoint process telemetry may prevent review of shell, script, administrative-tool, credential-access, discovery, remote-management, or persistence activity following gateway-originated access.

·        Missing firewall, NDR, flow, DNS, or proxy telemetry may prevent assessment of internal expansion, rare destinations, destination fan-out, cloud communication, or external callbacks.

·        Missing cloud identity and audit telemetry may prevent review of role activity, token use, storage access, management-plane activity, remote commands, secret retrieval, or access-policy changes.

·        Reverse proxies, NAT, load balancers, shared addresses, clustered nodes, and translated interfaces may obscure the original external source, affected appliance, remote user, or downstream action.

·        Appliance-local loopback or link-local communication may not cross external network sensors.

·        Closed or managed security appliances may not expose process, command-line, memory, file, database, credential-store, or session-resource telemetry.

·        Gateway logs may record a successful WebSocket upgrade or relay session without identifying the final connected service.

·        Workstation names may be absent, spoofed, reused, truncated, or inconsistently normalized.

·        Authentication, VPN-session, gateway, endpoint, and network telemetry may use different timestamps, identifiers, and retention periods.

·        Patching, rebooting, failover, configuration restoration, gateway replacement, or log rotation may remove evidence required to establish whether compromise occurred before remediation.

·        Missing change-control, vendor-support, monitoring, testing, maintenance, recovery, and incident-response records may prevent reliable false-positive control.

·        Short telemetry retention may prevent reconstruction of activity that occurred before patching, rebuild, credential rotation, TOTP reset, or gateway replacement.

Detection Boundary

·        Vulnerable firmware, internet exposure, CVE status, KEV status, or public exploit availability is not proof of successful gateway compromise.

·        A crafted request, unusual URI, encoded destination, proxy request, relay event, or WebSocket connection is not proof of successful appliance-local access without connection or follow-on evidence.

·        An HTTP 101 response or successful protocol upgrade is not proof of command execution, credential access, or identity pivoting.

·        A configuration, hotfix, route, service, account, or filesystem change is not proof of attacker activity without unauthorized context, suspicious timing, or linkage to external gateway interaction.

·        Authentication originating from a gateway is not proof of compromise when it matches an approved VPN session, directory-integration workflow, service account, destination, protocol, workstation, and service window.

·        A gateway-integrated account used from an unusual workstation name is not proof of compromise without supporting source, destination, session, protocol, or behavioral context.

·        Endpoint execution should not be attributed to gateway compromise without gateway-source, destination, process, user, session, or bounded time-window linkage.

·        Internal discovery, remote-service use, lateral movement, or cloud activity should not be attributed to gateway compromise without appliance, account, session, source, identity, resource, or bounded time-window correlation.

·        Certificate, token, cookie, session, or TOTP exposure should not be claimed without direct access evidence, downstream use, configuration evidence, incident-response findings, or a justified inability to rule out exposure.

·        Legitimate remote-access use, gateway administration, vendor support, monitoring, health checks, directory synchronization, backup, restoration, testing, penetration testing, failover, disaster recovery, and incident response can create overlapping signals.

·        Detection logic must not depend on another CyberDax alert, DRI score, TCR score, or post-alert analyst judgment as an input.

·        High-confidence conclusions should require validated multi-signal correlation across gateway interaction, appliance behavior, administrative activity, session context, identity use, endpoint activity, network behavior, and approved workflow evidence where applicable.

Operational Impact of Limitations

Detection coverage should be reduced, converted to hunt-only logic, or withheld when requested-destination visibility, gateway attribution, administrative logs, configuration history, VPN-session records, service-account mapping, workstation-name capture, endpoint telemetry, internal network visibility, cloud audit data, or bounded sequence correlation are unavailable or unreliable. Suspicious gateway or identity activity may remain analytically important but unsuitable for high-confidence compromise determination when the organization cannot validate whether external interaction became unauthorized appliance control or whether appliance control resulted in authentication-material exposure, identity pivoting, endpoint execution, internal expansion, or cloud-resource access.

S33 — Defensive Control & Hardening Improvements

Defensive improvement should focus on making gateway exposure, appliance-local access, administrative activity, authentication-material handling, gateway-originated authentication, downstream endpoint activity, internal expansion, cloud access, and trust restoration measurable, governed, and recoverable. The objective is not only to patch one gateway vulnerability or firmware version, but to prove that suspicious gateway-to-identity behavior can be prevented, detected, scoped, contained, and separated from legitimate remote-access, administration, support, and directory-service activity.

Gateway Asset, Vulnerability, and Exposure Governance

·        Maintain complete inventory of internet-facing gateways, VPN concentrators, secure access appliances, clustered nodes, virtual appliances, internal interfaces, translated addresses, disaster-recovery gateways, management interfaces, and cloud-hosted gateway instances.

·        Maintain historical firmware, hotfix, configuration, certificate, reboot, failover, patch, replacement, and remediation state rather than relying only on current scanner results.

·        Prioritize remediation for gateways supporting privileged administrators, third-party vendors, regulated applications, production systems, identity services, backup infrastructure, virtualization systems, storage systems, and cloud management.

·        Require auditable ownership, patch windows, hotfix validation, reboot validation, configuration comparison, failover validation, replacement criteria, exception approval, and remediation closure.

·        Treat unknown gateway ownership, unknown vulnerable-state history, unknown internal reachability, unknown service-account mapping, or unknown authentication-material exposure as unresolved enterprise risk.

Gateway Interface and Service Hardening

·        Restrict proxy, relay, WebSocket, API, administrative, support, diagnostic, monitoring, and management functions to required users, networks, services, and approved access paths.

·        Prevent externally supplied requests from reaching loopback, localhost, link-local, appliance-local, internal management, diagnostic, control, or prohibited destinations.

·        Apply strict destination validation, request normalization, protocol validation, allowlisting, access control, segmentation, and management-plane isolation where supported.

·        Disable unnecessary gateway services, administrative endpoints, support functions, legacy protocols, test interfaces, and unauthenticated features.

·        Require dedicated management networks, restricted administrative source ranges, multifactor authentication, privileged-access workflows, and session recording where feasible.

Administrative, Configuration, and Hotfix Hardening

·        Restrict gateway administration to named accounts, approved workstations, approved jump hosts, dedicated management paths, and time-bounded privileged access.

·        Require change-control for firmware, hotfix, configuration, route, service, account, access-rule, certificate, script, and filesystem changes.

·        Maintain known-good configuration, route, service, account, certificate, and access-rule baselines.

·        Monitor and alert on unauthorized hotfix removal, route creation, service changes, account changes, access-rule changes, script execution, temporary-file activity, and suspicious path traversal.

·        Preserve administrative, configuration, backup, restoration, and support records before gateway patching, rebuild, failover, or replacement.

Credential, Session, Token, Certificate, and TOTP Protection

·        Minimize stored administrator credentials, directory-integration credentials, service-account material, long-lived sessions, reusable tokens, exported configuration secrets, recoverable TOTP seeds, and broadly trusted certificates.

·        Use dedicated least-privileged service accounts for directory integration and separate them from interactive administration.

·        Restrict access to session databases, credential stores, configuration exports, certificate stores, token material, multifactor records, and TOTP seed data.

·        Use short-lived sessions, scoped tokens, secure certificate storage, protected secret management, automated rotation, and rapid revocation where available.

·        Require credential, session, token, certificate, and TOTP rotation or reset when gateway compromise or authentication-material exposure cannot be ruled out.

Identity and Directory-Service Hardening

·        Map each gateway to approved service accounts, workstation names, domain controllers, LDAP servers, identity providers, protocols, destinations, and service windows.

·        Restrict gateway-integrated accounts to required directory functions and prevent interactive logon, broad domain access, or unrelated resource access.

·        Monitor gateway-originated NTLM, Kerberos, LDAP, LDAPS, SMB, certificate, token, and application authentication for missing VPN-session context or baseline deviation.

·        Require strong authentication, managed service accounts where supported, account rotation, source restrictions, protocol restrictions, and destination restrictions.

·        Disable or remediate shared, overprivileged, stale, undocumented, or broadly reusable gateway service accounts.

Network Segmentation and Internal Reachability Hardening

·        Restrict gateway communication to required identity services, applications, management systems, monitoring systems, update services, and approved cloud resources.

·        Prevent remote-access gateways from broadly reaching domain infrastructure, backup platforms, virtualization systems, storage systems, administrative jump hosts, and unrelated internal networks.

·        Apply destination, port, protocol, identity, and service allowlists to gateway-originated traffic.

·        Monitor new destinations, rare destinations, destination fan-out, unusual ports, unusual protocols, repeated failures, service enumeration, and access to high-value systems.

·        Separate remote-user traffic from appliance-originated administrative, directory-service, monitoring, update, and management communication where feasible.

Endpoint and Downstream System Hardening

·        Ensure endpoints receiving remote-access connections have EDR, process telemetry, network attribution, command-line logging, credential protection, and administrative-tool monitoring.

·        Restrict remote-management tools, scripting engines, administrative utilities, service creation, scheduled activity, and credential-access capability to approved workflows.

·        Correlate gateway-source connections with endpoint process creation and user sessions.

·        Segment privileged endpoints, administrative workstations, jump hosts, domain controllers, backup systems, virtualization platforms, storage systems, and cloud-management systems from general remote-access paths.

·        Isolate downstream endpoints when suspicious gateway-originated access aligns with unexpected execution, credential access, discovery, remote administration, or persistence.

Logging, Monitoring, and Evidence Hardening

·        Preserve gateway web, proxy, relay, WebSocket, VPN-session, administrative, configuration, system, health, authentication, firewall, NDR, endpoint, identity, and cloud telemetry.

·        Normalize gateway identity, source address, requested destination, session identifier, account, workstation name, destination, protocol, and timestamp fields.

·        Use remote log forwarding, centralized storage, immutable or write-protected retention, time synchronization, health monitoring, and alerting on logging disruption.

·        Preserve evidence before patching, rebooting, restoring configuration, failing over, replacing the appliance, rotating credentials, or resetting TOTP material.

·        Validate that logging, authentication correlation, session visibility, and security controls remain healthy after containment and remediation.

Incident Response and Containment Hardening

·        Create response procedures for suspicious external gateway interaction, appliance-local service access, unauthorized configuration, hotfix removal, session exposure, credential exposure, TOTP exposure, gateway-originated authentication, endpoint execution, internal expansion, and cloud access.

·        Require responders to validate gateway identity, vulnerable-state history, requested destination, connection result, administrative activity, configuration differences, session context, account use, workstation name, endpoint behavior, internal destination, cloud resource, and remediation status.

·        Prepare decision paths for isolation, failover, evidence preservation, patching, rebuild, replacement, credential rotation, TOTP reset, session revocation, service-account restriction, endpoint containment, cloud-role restriction, legal review, compliance review, cyber-insurance coordination, communications planning, and executive reporting.

·        Treat suspected gateway compromise as an appliance-trust and identity-trust incident, not only as a firmware-management or patching event.

·        Require post-event validation that no unexplained authentication, endpoint execution, internal access, service-account use, session reuse, or cloud activity continued after remediation.

S34 — Defensive Control & Hardening Architecture

Figure 6

The defensive architecture should treat secure remote-access gateways as governed trust-bearing infrastructure rather than isolated perimeter appliances. The architecture must connect gateway inventory, vulnerable-state history, external-request visibility, appliance-local access controls, administrative integrity, authentication-material protection, identity correlation, endpoint monitoring, network segmentation, cloud visibility, incident-response containment, and executive trust restoration into one gateway-to-identity-to-impact assurance model.

Architecture Layer One — Gateway Asset and Trust Governance

Gateway asset and trust governance establishes which gateways, clustered nodes, virtual appliances, internal interfaces, translated addresses, disaster-recovery systems, administrative paths, identity integrations, remote-user populations, privileged-access relationships, and downstream resources exist. This layer captures ownership, business criticality, internet exposure, firmware state, hotfix state, configuration state, internal reachability, service-account mapping, cloud connectivity, and remediation status.

Architecture Layer Two — External Interaction and Request Validation

External interaction and request validation determines whether internet-originated requests are legitimate remote-access traffic, scanning, failed exploitation, authorized testing, vendor support, or suspicious attempts to reach appliance-local or internal services. This layer captures HTTP method, URI, requested host, requested destination, requested IP, requested port, encoding, protocol upgrade, proxy result, relay result, source address, session, response status, and gateway node.

Architecture Layer Three — Appliance-Local Access and Control-Plane Integrity

Appliance-local access and control-plane integrity determines whether suspicious external interaction reached loopback, localhost, link-local, appliance-local, diagnostic, management, control, or prohibited services and whether the appliance experienced unauthorized command, configuration, route, service, account, access-rule, script, or filesystem activity. This layer captures administrative events, system events, configuration changes, hotfix changes, route changes, service changes, file activity, support context, and change approval.

Architecture Layer Four — Authentication-Material and Session Protection

Authentication-material and session protection determines whether gateway administrator credentials, directory-integration accounts, active sessions, cookies, tokens, certificates, VPN context, multifactor records, or TOTP seed material were exposed. This layer captures resource access, exports, configuration access, session-database activity, certificate access, token use, session reuse, credential rotation, TOTP reset, and revocation status.

Architecture Layer Five — Identity and VPN-Session Correlation

Identity and VPN-session correlation determines whether gateway-originated authentication matches an authorized remote-access session or approved directory-service workflow. This layer captures account, account type, workstation name, source address, destination, authentication protocol, logon type, result, session identifier, assigned client address, service window, gateway node, and approved context.

Architecture Layer Six — Endpoint and Downstream Execution Monitoring

Endpoint and downstream execution monitoring determines whether gateway-originated access resulted in suspicious process, user, file, service, credential-access, discovery, remote-management, or persistence activity. This layer captures endpoint network events, process ancestry, command line, executable path, user, logon session, file activity, credential access, service creation, scheduled activity, and endpoint criticality.

Architecture Layer Seven — Network Segmentation and Internal Expansion Monitoring

Network segmentation and internal expansion monitoring determines whether the gateway communicated with identity systems, management platforms, backup infrastructure, virtualization systems, storage systems, jump hosts, administrative services, or multiple unusual destinations outside its approved role. This layer captures firewall, NDR, flow, destination rarity, destination count, failed-connection ratio, protocol, port, destination role, first-seen status, and approved peer baselines.

Architecture Layer Eight — Cloud and Multi-Environment Trust Monitoring

Cloud and multi-environment trust monitoring determines whether gateway-associated addresses, accounts, sessions, tokens, certificates, or trusted access paths were used against AWS, Azure, or Google Cloud identity, management, storage, backup, administrative, or workload resources. This layer captures sign-ins, role use, token activity, API actions, storage activity, backup activity, remote commands, policy changes, source address, user agent, resource, and approved automation context.

Architecture Layer Nine — SOC Correlation and False-Positive Control

SOC correlation joins gateway asset context, vulnerable-state history, request behavior, protocol results, administrative activity, configuration differences, session data, authentication behavior, endpoint execution, internal network activity, cloud activity, change-control records, and approved workflow baselines. This layer distinguishes attacker-driven activity from legitimate remote access, directory integration, vendor support, monitoring, health checks, backup, restoration, maintenance, testing, penetration testing, failover, disaster recovery, and incident response.

Architecture Layer Ten — Incident Response and Executive Trust Workflow

Incident response and executive trust workflow connects technical evidence to containment and business decisions. This layer captures incident severity, affected gateway, nodes, sessions, accounts, service accounts, endpoints, internal resources, cloud resources, credential exposure, TOTP exposure, containment actions, failover, rebuild, replacement, credential rotation, session revocation, legal review, compliance review, cyber-insurance coordination, communications planning, executive reporting, and confirmation that gateway and identity trust can be restored.

Architecture Outcome

The architecture should enable the organization to answer seven questions during a secure remote-access gateway compromise and identity-pivoting incident:

·        Which gateway, node, external source, request, local destination, administrative action, configuration object, session, account, workstation, endpoint, internal system, cloud resource, business owner, or remediation action was affected?

·        Did the activity align with approved remote access, directory integration, gateway administration, vendor support, monitoring, health checks, maintenance, backup, restoration, testing, failover, disaster recovery, or incident response?

·        Did suspicious external interaction result in appliance-local service access or unauthorized gateway control?

·        Did gateway compromise expose credentials, sessions, tokens, certificates, TOTP material, service accounts, or trusted authentication paths?

·        Did exposed identities or gateway trust result in endpoint execution, internal expansion, cloud activity, or continued post-remediation access?

·        Can the organization isolate or replace affected gateways, preserve evidence, validate vulnerable-state history, revoke sessions, rotate credentials, reset TOTP material, restrict service accounts, contain endpoints, and review cloud access without over-attributing legitimate gateway operations?

·        Can leadership make defensible decisions about remote-access trust, identity exposure, endpoint impact, internal infrastructure exposure, cloud exposure, legal obligations, cyber-insurance coordination, and return-to-service approval?

S35 — Defensive Control Mapping Matrix

Preventive Controls

·        Maintain complete inventory of gateways, clustered nodes, virtual appliances, translated addresses, internal interfaces, management interfaces, identity integrations, service accounts, remote-user populations, privileged-access paths, business owners, firmware state, configuration state, and downstream trust dependencies.

·        Enforce timely patching, hotfix validation, reboot validation, configuration comparison, failover validation, replacement criteria, exception governance, and remediation closure.

·        Restrict proxy, relay, WebSocket, API, administrative, diagnostic, support, monitoring, and management functions to required networks, users, services, and destinations.

·        Prevent external requests from reaching loopback, localhost, link-local, appliance-local, internal management, diagnostic, control, or prohibited services.

·        Enforce dedicated administrative accounts, privileged-access workflows, source restrictions, multifactor authentication, named administrators, approved workstations, and time-bounded access.

·        Protect active sessions, credentials, tokens, certificates, directory-integration accounts, service accounts, multifactor records, and TOTP material through least privilege, secure storage, short-lived authentication, and rotation.

·        Restrict gateway communication to approved identity systems, applications, management services, monitoring systems, update services, and cloud resources.

·        Segment domain controllers, privileged endpoints, backup systems, virtualization platforms, storage systems, jump hosts, and cloud-management systems from broad gateway reachability.

·        Protect logging, configuration baselines, administrative records, VPN-session records, identity logs, firewall data, NDR data, endpoint telemetry, and cloud audit data from deletion or unauthorized modification.

Detective Controls

·        Monitor external requests referencing loopback, localhost, link-local, appliance-local, encoded, malformed, internal, or prohibited destinations.

·        Monitor successful protocol upgrades, proxy connections, relay-session creation, appliance-local service access, and repeated failed-to-success connection patterns.

·        Monitor unauthorized hotfix removal, configuration changes, route changes, service changes, account changes, access-rule changes, script execution, temporary-file activity, and filesystem modification.

·        Monitor access to active-session data, cookies, tokens, certificates, credential stores, directory-integration credentials, multifactor records, and TOTP seed material where telemetry exists.

·        Monitor gateway-originated authentication without a matching VPN session or approved service context.

·        Monitor gateway-integrated accounts for unfamiliar workstation names, destinations, protocols, source contexts, and service windows.

·        Monitor gateway-source connections followed by suspicious endpoint shell, script, administrative-tool, credential-access, discovery, remote-management, or persistence activity.

·        Monitor new or rare internal destinations, destination fan-out, unusual ports, unusual protocols, repeated failures, and access to identity, management, backup, virtualization, storage, and administrative systems.

·        Monitor unusual AWS, Azure, and Google Cloud sign-ins, API activity, storage access, backup access, management-plane activity, remote commands, identity changes, and security-control changes involving gateway-associated accounts or addresses.

·        Require multi-signal correlation before high-confidence compromise or impact determination.

Responsive Controls

·        Isolate affected gateways or remove them from service when appliance integrity cannot be established.

·        Fail over to known-good infrastructure only after validating configuration, firmware, hotfix, certificate, identity, session, and service-account state.

·        Preserve web, proxy, relay, WebSocket, administrative, configuration, system, health, VPN-session, authentication, endpoint, firewall, NDR, flow, and cloud evidence before cleanup or replacement.

·        Revoke active sessions, disable compromised accounts, restrict service accounts, rotate administrator and directory-integration credentials, replace certificates where required, and reset TOTP material when exposure cannot be ruled out.

·        Compare affected gateway configurations, routes, services, accounts, access rules, certificates, and files with known-good baselines.

·        Investigate downstream endpoints, identity systems, management systems, backup platforms, virtualization systems, storage systems, cloud resources, and other high-value destinations.

·        Rebuild or replace affected gateways when forensic confidence is insufficient.

·        Perform legal, compliance, privacy, cyber-insurance, communications, customer-impact, partner-impact, executive, and board-level review where credential exposure, identity compromise, regulated-system exposure, cloud access, remote-access disruption, or incomplete containment is suspected.

·        Confirm that appliance integrity, session state, credential state, TOTP state, service-account behavior, endpoint activity, internal access, cloud activity, and post-remediation monitoring support closure.

Governance Controls

·        Maintain approved inventories for gateways, nodes, interfaces, identities, service accounts, certificates, sessions, internal destinations, cloud relationships, business owners, network owners, identity owners, application owners, and security-control owners.

·        Maintain approved workflows for remote access, directory integration, gateway administration, vendor support, monitoring, health checks, patching, hotfix activity, backup, restoration, failover, testing, penetration testing, disaster recovery, and incident response.

·        Require change-control for firmware, hotfix, configuration, route, service, account, access-rule, certificate, identity-integration, management-interface, and emergency-remediation changes.

·        Maintain escalation criteria for suspicious appliance-local access, unauthorized gateway control, authentication-material exposure, unexplained gateway-originated authentication, endpoint execution, internal expansion, cloud activity, and post-remediation access.

·        Track gateway and identity-pivoting risk in the enterprise risk register when inventory, patching, session correlation, service-account governance, logging, endpoint visibility, network segmentation, cloud visibility, or recovery gaps create unresolved exposure.

Control Mapping Summary

The strongest control posture combines prevention of unintended appliance-local access, protection of gateway-held authentication material, restriction of gateway-originated identity and network activity, behavior-led detection of gateway-to-identity sequences, and response workflows that restore appliance trust, session confidence, credential integrity, service-account assurance, endpoint integrity, cloud assurance, and business continuity. Controls should be prioritized for internet-facing gateways supporting privileged users, third-party vendors, regulated services, identity systems, production applications, backup infrastructure, virtualization systems, storage systems, administrative networks, and cloud-management paths.

S36 — CyberDax Intelligence Maturity Assessment

Current Intelligence Maturity

Moderate to High

Maturity Rationale

Secure remote-access gateway compromise and identity pivoting form a mature behavior-led intelligence model because the assessment is not dependent on one CVE, gateway vendor, appliance model, firmware version, exploit name, request path, source IP address, WebSocket endpoint, proof-of-concept repository, or actor. Organization-specific maturity depends on whether suspicious external interaction, appliance-local service access, unauthorized gateway activity, authentication-material exposure, VPN-session context, gateway-originated authentication, endpoint execution, internal expansion, and cloud activity can be correlated across appliance, account, session, workstation, endpoint, destination, resource, and time.

Strengths

·        The governing behavior is durable across changing gateway vulnerabilities, vendors, appliance functions, request encodings, proxy mechanisms, relay paths, WebSocket implementations, accounts, and downstream destinations.

·        The core sequence is analytically clear: suspicious external interaction, appliance-local service access or unauthorized control, authentication-material exposure, gateway-originated authentication, and conditional downstream expansion.

·        Detection opportunities are strong where gateway web, administrative, configuration, VPN-session, identity, endpoint, network, and cloud telemetry can be correlated.

·        S25 provides behavior-led coverage across NDR, SentinelOne, Splunk, Elastic, QRadar, SIGMA, AWS, Azure, and GCP while correctly allowing zero YARA viability where artifact-driven detection would be weak.

·        Defensive controls map directly to gateway inventory, interface restriction, administrative integrity, credential protection, session control, service-account governance, network segmentation, endpoint monitoring, cloud visibility, and containment validation.

·        Blocks 1 through 5 remain aligned to the EXP behavior model without reverting to a single-CVE, single-vendor, or patch-only assessment.

Maturity Gaps

·        Gateway inventory may not reliably identify clustered nodes, translated addresses, internal interfaces, identity integrations, business criticality, remote-user populations, or downstream trust relationships.

·        Historical firmware, hotfix, configuration, reboot, failover, and replacement data may be incomplete.

·        Gateway logs may omit requested destinations, decoded values, protocol results, relay details, administrative attribution, or final connected services.

·        Closed appliances may not expose process, command-line, memory, file, database, session-resource, or credential-access telemetry.

·        VPN-session records may be delayed, incomplete, or disconnected from identity telemetry.

·        Gateway-to-service-account, gateway-to-workstation, and gateway-to-destination mappings may be undocumented or stale.

·        Workstation names and client addresses may be missing, spoofed, reused, or inconsistently normalized.

·        Endpoint network events may not preserve the original remote user, external source, or gateway session.

·        Internal network telemetry may lack application, account, process, or session attribution.

·        Cloud activity may not map reliably back to the gateway, account, token, session, or source address involved.

·        Change-control, vendor-support, testing, failover, restoration, and incident-response records may be insufficient for false-positive control.

·        Organizations may over-rely on vulnerable firmware, CVE status, KEV status, exploit strings, source IPs, isolated WebSocket events, configuration changes, or authentication anomalies.

Maturity Improvement Priorities

·        Normalize gateway asset identity, node mapping, interfaces, translated addresses, business criticality, remote-user population, identity integrations, internal destinations, cloud relationships, firmware state, hotfix state, configuration state, and remediation status.

·        Improve requested-host, requested-IP, requested-destination, decoding, protocol-upgrade, proxy-result, relay-result, and session visibility.

·        Improve administrative, configuration, hotfix, route, service, account, access-rule, certificate, script, and file-change telemetry.

·        Improve VPN-session correlation with gateway-originated authentication.

·        Improve service-account, workstation-name, protocol, destination, and service-window baselines.

·        Improve visibility into session, token, certificate, credential-store, multifactor, and TOTP access where the gateway platform supports it.

·        Improve gateway-source-to-endpoint process correlation.

·        Improve internal firewall, NDR, flow, DNS, destination-rarity, and destination-fan-out visibility.

·        Improve cloud sign-in, identity, token, API, storage, backup, management-plane, and source-address correlation.

·        Improve remediation evidence for gateway rebuild, gateway replacement, credential rotation, session revocation, TOTP reset, service-account restriction, endpoint containment, cloud review, and post-remediation monitoring.

·        Add gateway-to-identity validation steps to SOC, network engineering, identity engineering, endpoint security, cloud security, vulnerability management, incident response, legal, compliance, cyber-insurance, communications, business continuity, and executive reporting workflows.

Maturity Outlook

Maturity can improve quickly when the organization prioritizes complete gateway inventory, historical vulnerable-state records, requested-destination visibility, administrative logging, configuration baselines, VPN-session correlation, service-account governance, workstation-name capture, endpoint correlation, internal network segmentation, cloud attribution, and post-remediation assurance. The highest-value improvements are those that prove whether suspicious external interaction became unauthorized appliance control and whether appliance control created broader session, credential, identity, endpoint, internal-network, or cloud exposure.

S37 — Strategic Defensive Improvements

Strategic improvement should focus on reducing the probability that an exposed secure remote-access gateway can be converted into appliance control and reducing the amount of reusable identity and internal trust available if compromise succeeds. The organization should treat gateway compromise as a cross-functional resilience problem spanning network security, remote-access engineering, identity, endpoint security, cloud security, vulnerability management, detection engineering, incident response, business continuity, legal, compliance, cyber insurance, communications, and executive governance.

Priority One — Establish Gateway Trust-Tier Governance

·        Classify gateways by internet exposure, privileged-user population, third-party access, identity integration, internal reachability, cloud connectivity, regulated-system dependency, business criticality, and recovery importance.

·        Apply stronger patching, logging, session, identity, segmentation, credential, administrative, and rebuild requirements to high-trust gateways.

·        Treat gateways connected to domain controllers, privileged-access systems, backup platforms, virtualization systems, storage systems, administrative networks, cloud control planes, and regulated applications as elevated trust tiers.

·        Require explicit ownership, replacement criteria, failover procedures, evidence-preservation requirements, and restoration criteria for every elevated-trust gateway.

Priority Two — Reduce Appliance-Local Access Opportunity

·        Restrict proxy, relay, WebSocket, API, diagnostic, support, administrative, and management functionality to required use cases.

·        Prevent externally supplied destinations from resolving to loopback, localhost, link-local, appliance-local, internal management, control, diagnostic, or prohibited services.

·        Apply strict request normalization, destination allowlisting, protocol enforcement, service isolation, management-plane segmentation, and access control.

·        Remove or disable unnecessary services, endpoints, legacy protocols, support interfaces, and test functions.

Priority Three — Reduce Authentication-Material Concentration

·        Minimize stored administrator credentials, directory-integration credentials, service-account material, active sessions, long-lived tokens, broadly trusted certificates, recoverable TOTP seeds, and reusable configuration secrets.

·        Replace shared or standing credentials with named administration, managed service accounts, short-lived authentication, scoped tokens, protected secrets, and automated rotation where feasible.

·        Separate remote-user authentication, gateway administration, directory integration, monitoring, backup, support, and cloud identities.

·        Maintain rapid session revocation, credential rotation, certificate replacement, service-account restriction, and TOTP reset procedures.

Priority Four — Restrict Identity and Internal Trust Paths

·        Limit gateway-integrated accounts to required directory functions, destinations, protocols, source addresses, and service windows.

·        Prevent gateway service accounts from interactive logon, broad domain access, workstation access, cloud access, or unrelated administrative functions.

·        Restrict gateway-originated traffic to approved identity systems, applications, management services, monitoring systems, update services, and cloud resources.

·        Segment domain controllers, backup systems, virtualization platforms, storage systems, privileged endpoints, jump hosts, and cloud-management systems from broad remote-access reachability.

Priority Five — Build Sequence-Based Detection and Response

·        Detect the durable sequence rather than individual artifacts: suspicious external request, appliance-local connection, unauthorized gateway activity, authentication-material exposure, unexplained authentication, endpoint execution, internal expansion, and cloud activity.

·        Preserve gateway identity, requested destination, protocol result, administrative context, configuration history, session context, account, workstation name, endpoint process, internal destination, and cloud-resource attribution.

·        Route detections according to gateway trust tier and business criticality without weakening evidence requirements.

·        Require investigation playbooks to distinguish scanning, failed exploitation, successful gateway compromise, authentication-material exposure, identity pivoting, and confirmed downstream impact.

Priority Six — Make Gateway Rebuild and Trust Restoration Routine

·        Predefine when affected gateways, nodes, virtual appliances, high-availability pairs, or disaster-recovery systems must be rebuilt or replaced.

·        Maintain trusted firmware, configuration baselines, certificates, secure backups, failover capability, credential-rotation capability, session-revocation capability, and tested replacement procedures.

·        Do not return a gateway to service solely because firmware was patched, the appliance rebooted, or the suspicious request stopped.

·        Require explicit validation of appliance integrity, configuration state, session state, credential state, TOTP state, service-account behavior, endpoint activity, internal access, cloud activity, and post-remediation telemetry.

Priority Seven — Integrate Executive and Business Decisioning

·        Define escalation thresholds for suspected compromise of gateways supporting privileged administrators, third-party vendors, regulated services, production systems, identity services, backup infrastructure, virtualization systems, storage systems, and cloud-management paths.

·        Maintain decision paths for remote-access suspension, failover, customer impact, partner impact, legal review, compliance review, privacy review, cyber-insurance coordination, communications planning, credential rotation, TOTP reset, service-account restriction, and board reporting.

·        Track unresolved gateway trust, identity, logging, segmentation, session, credential, and recovery gaps in the enterprise risk register.

·        Require leadership assurance that gateway, session, credential, identity, endpoint, internal-network, and cloud trust can be restored before normal operations resume.

Strategic Outcome

The target state is an environment in which external gateway interaction is less likely to reach appliance-local services, successful compromise exposes less reusable authentication material, gateway-originated identity and network activity is tightly restricted, suspicious behavior can be reconstructed across appliance, identity, endpoint, network, and cloud systems, affected gateways can be rapidly replaced, and leadership can make defensible decisions about remote-access trust, credential exposure, identity compromise, internal-system exposure, cloud risk, operational impact, and return to service.

S38 — Attack Economics & Organizational Impact Model

Figure 7

Secure remote-access gateway compromise changes intrusion economics by allowing an adversary to target one internet-facing trust broker that may connect remote users, privileged administrators, vendors, service accounts, identity systems, internal applications, management platforms, cloud resources, backup infrastructure, virtualization environments, storage systems, and regulated services. When suspicious external interaction, appliance-local service access, unauthorized gateway control, authentication-material exposure, gateway-originated authentication, endpoint execution, internal expansion, or cloud-resource access align within one investigation window, the adversary can create disproportionate business uncertainty without compromising every endpoint, account, internal system, cloud service, or user individually.

The organization’s cost expands when responders must determine whether suspicious gateway activity remained limited to scanning, failed exploitation, authorized testing, vendor support, or routine administration; whether appliance-local access or unauthorized control occurred; whether sessions, credentials, tokens, certificates, or TOTP material were exposed; whether gateway-originated authentication was legitimate; whether downstream endpoints or internal systems were accessed; whether cloud resources were affected; and whether remote-access and identity trust can safely return to service after remediation.

Adversary Economic Advantage

·        An internet-facing gateway reduces attacker friction because the adversary can interact directly with a system designed to receive external connections and broker trusted access into the enterprise.

·        Gateway proxy, relay, WebSocket, API, administrative, diagnostic, and request-routing functions can provide paths toward appliance-local, loopback, link-local, internal management, or otherwise restricted services.

·        Successful gateway compromise can provide a direct path from external interaction to appliance control without requiring initial compromise of an internal endpoint.

·        Appliance control can expose administrator credentials, directory-integration accounts, service accounts, active sessions, cookies, authentication tokens, certificates, VPN context, multifactor records, TOTP seed material, configuration secrets, and trusted routing information.

·        Gateway-originated authentication may blend into expected operations because internal identity systems are accustomed to receiving LDAP, Kerberos, NTLM, SMB, certificate, token, or application authentication from the appliance and its integrated accounts.

·        A compromised gateway can provide a trusted source address and established communication path to domain controllers, identity systems, internal applications, management platforms, backup systems, virtualization infrastructure, storage systems, administrative jump hosts, and cloud resources.

·        Public proof-of-concept code, repeatable request patterns, exposed gateway interfaces, commodity scanning, common appliance deployments, and published vulnerability details can reduce the cost of exploit discovery and adaptation.

·        Normal remote-access activity, directory synchronization, gateway administration, vendor support, monitoring, health checks, backup, restoration, testing, maintenance, failover, disaster recovery, and incident-response work can make attacker-driven activity harder to classify quickly.

·        Closed or managed appliance architecture can reduce the likelihood that direct process, command-line, memory, file, database, session-resource, or credential-access evidence is available.

·        Shared addresses, NAT, reverse proxies, clustered nodes, translated interfaces, and incomplete session attribution can obscure the original external source, affected appliance, remote user, or downstream action.

·        A single compromised gateway with privileged service accounts, active sessions, broad internal reachability, cloud connectivity, or large remote-user dependency can create disproportionate downstream exposure.

·        The adversary benefits when defenders cannot quickly determine whether gateway-originated authentication, service-account use, session reuse, endpoint execution, internal access, or cloud activity was legitimate or attacker-driven.

·        Downstream impact can extend into emergency gateway isolation, remote-access suspension, failover, credential rotation, session revocation, certificate replacement, TOTP reset, endpoint containment, cloud-role restriction, gateway rebuild, legal review, compliance assessment, cyber-insurance coordination, communications planning, executive reporting, and trust restoration.

Defender Cost Expansion

·        The organization must investigate both the suspicious gateway activity and the reliability of the gateway, administrative, configuration, VPN-session, authentication, endpoint, network, cloud, change-control, remediation, and business-context evidence needed to confirm or disprove impact.

·        Response teams may need to reconstruct the external request, requested destination, protocol upgrade, proxy or relay result, appliance-local service access, administrative activity, configuration change, session exposure, account use, workstation attribution, endpoint process activity, internal network communication, and cloud-resource access.

·        Mitigation may require emergency patching, gateway isolation, failover, traffic rerouting, configuration comparison, certificate review, session revocation, credential rotation, TOTP reset, service-account restriction, endpoint containment, cloud-role restriction, gateway rebuild, clustered-node replacement, and post-remediation monitoring.

·        Internal exposure scoping may be required across affected gateways, clustered nodes, remote-user populations, administrator accounts, directory-integration accounts, service accounts, active sessions, identity systems, endpoints, management platforms, backup systems, virtualization infrastructure, storage systems, cloud resources, applications, and business owners.

·        Response cost increases when gateway inventory, vulnerable-state history, requested-destination fields, administrative attribution, configuration baselines, VPN-session records, service-account mappings, workstation names, endpoint telemetry, network attribution, cloud logs, or credential-rotation evidence are incomplete.

·        Business impact increases when defenders must determine whether appliance control occurred, whether authentication material was exposed, whether identities were abused, whether endpoints or internal systems were accessed, whether cloud resources were affected, and whether remote-access operations can safely continue.

·        Investigation scope expands when multiple gateways, shared configurations, clustered nodes, reusable service accounts, common certificates, broad identity integrations, centralized management systems, or repeated vulnerable conditions create uncertainty across several sites or environments.

·        Legal, compliance, privacy, customer, partner, cyber-insurance, communications, executive, and board-level costs increase when credential exposure, session hijacking, TOTP compromise, regulated-system access, cloud-resource activity, remote-access disruption, production impact, data exposure, or incomplete containment cannot be ruled out.

Organizational Impact Model

Gateway Asset and Remote-Access Trust Impact

The organization must determine which secure remote-access gateways, VPN concentrators, application-access gateways, virtual appliances, clustered nodes, high-availability systems, cloud-hosted gateways, disaster-recovery appliances, translated addresses, internal interfaces, and management interfaces were exposed, vulnerable, affected, rebuilt, replaced, failed over, or connected to suspicious activity during the investigation window.

External Interaction and Appliance-Control Impact

The organization must determine whether crafted HTTP, API, proxy, relay, WebSocket, tunneling, administrative, diagnostic, or request-routing activity remained limited to scanning, failed exploitation, testing, support, or routine operation, or progressed into appliance-local service access, unauthorized command or script execution, configuration manipulation, hotfix removal, route changes, service changes, account changes, access-rule changes, or filesystem activity.

Credential, Session, Token, Certificate, and TOTP Impact

The organization must determine whether gateway administrator credentials, directory-integration accounts, LDAP credentials, service accounts, active sessions, cookies, authentication tokens, certificates, VPN context, multifactor records, TOTP seed material, configuration secrets, or other reusable authentication resources were accessed, exported, copied, exposed, rotated, revoked, replaced, reset, or used after suspected compromise.

Identity and Directory-Service Impact

The organization must determine whether gateway-originated NTLM, Kerberos, LDAP, LDAPS, SMB, certificate, token, application, or cloud authentication matched authorized VPN sessions and approved service workflows, or represented service-account abuse, valid-account use, session reuse, alternate authentication material use, or identity pivoting into internal or cloud environments.

Endpoint and Internal-System Impact

The organization must determine whether gateway-originated access resulted in shell, script, administrative-utility, credential-access, discovery, remote-management, service, scheduled-task, or persistence activity on downstream endpoints, or access to domain controllers, identity systems, management platforms, backup systems, virtualization infrastructure, storage systems, jump hosts, internal applications, or other high-value resources.

Cloud and Multi-Environment Trust Impact

The organization must determine whether gateway-associated addresses, compromised accounts, sessions, tokens, certificates, service accounts, or trusted access paths were used to reach AWS, Azure, or Google Cloud identity, management, storage, backup, administrative, or workload resources.

Security-Control and Evidence-Reliability Impact

The organization must determine whether gateway logging, administrative records, configuration history, VPN-session telemetry, identity logs, endpoint telemetry, firewall records, NDR data, cloud audit records, time synchronization, source attribution, and evidence retention remained complete, accurate, and reliable throughout the event and remediation window.

Persistence and Post-Remediation Impact

The organization must determine whether unauthorized accounts, modified services, altered routes, changed access rules, stolen sessions, exposed credentials, tokens, certificates, TOTP material, service-account access, endpoint persistence, or downstream identities allowed activity to continue after patching, rebooting, failover, configuration restoration, credential rotation, gateway rebuild, or initial containment.

Remote-Access Availability and Business-Continuity Impact

The organization must determine whether employee access, privileged administration, vendor connectivity, partner access, customer support, production operations, regulated services, disaster-recovery capability, or business-critical workflows were disrupted, restricted, rerouted, degraded, or placed at risk because gateway integrity and identity trust could not be confirmed.

Containment and Trust-Restoration Impact

The organization must restore gateway integrity, session confidence, credential assurance, certificate confidence, TOTP assurance, service-account trust, endpoint integrity, internal-network confidence, cloud confidence, and business continuity through vulnerable-state validation, evidence preservation, gateway isolation, failover, configuration comparison, gateway rebuild or replacement, credential rotation, session revocation, certificate replacement, TOTP reset, endpoint investigation, cloud review, legal assessment, compliance review, cyber-insurance coordination, executive reporting, and post-remediation monitoring.

Governance Impact

Leadership may need to treat confirmed or strongly suspected secure remote-access gateway compromise as an executive-level appliance-trust, identity-trust, remote-access, and infrastructure-risk incident because affected gateways may connect employees, administrators, vendors, partners, service accounts, identity systems, production applications, cloud resources, backup infrastructure, virtualization platforms, storage systems, regulated workloads, and business-critical services.

Economic Impact Summary

Secure remote-access gateway compromise and identity pivoting create economic advantage for adversaries because one exposed trust broker can be converted into appliance control and possible access to sessions, credentials, tokens, certificates, TOTP material, service accounts, endpoints, internal systems, and cloud resources. The organization’s financial exposure grows when it cannot quickly determine whether suspicious activity remained limited to failed exploitation, whether appliance control was obtained, whether authentication material was exposed, whether gateway-originated authentication was legitimate, whether endpoints or internal resources were accessed, whether cloud activity occurred, and whether gateway and identity trust can safely return to operation.

S39 — Economic Impact & Organizational Exposure

Secure remote-access gateway compromise and identity pivoting expand organizational exposure by increasing uncertainty around whether suspicious external interaction progressed into appliance-local service access, Windows RRAS service-context execution, unauthorized VPN-session establishment, unauthorized gateway or management-plane control, authentication-material exposure, unauthorized administrative authentication, security-policy or configuration modification, gateway-originated authentication, endpoint execution, internal expansion, cloud-resource access, persistence, ransomware-enabling access, or continued access after remediation.

The governing risk is not limited to CVE-2026-83548, CVE-2026-83549, CVE-2025-53521, CVE-2025-14733, CVE-2026-50751, CVE-2026-26111, CVE-2026-25173, CVE-2026-25172, CVE-2026-20349, CVE-2026-15409, CVE-2026-15410, CVE-2026-16232, the strongSwan 6.1.0 vulnerability set, one Windows RRAS vulnerability, one SonicWall appliance family, one WatchGuard Fireware vulnerability, one Cisco Secure Firewall vulnerability, one Check Point Remote Access VPN implementation, one OpenVPN implementation, one strongSwan implementation, one Check Point management-server version, one WebSocket function, one proxy endpoint, one authentication-bypass implementation, one exploit implementation, one malware family, one ransomware affiliate, or one adversary. The material question is whether an exposed remote-access gateway, Windows RRAS server, VPN service, or associated security-management platform was converted into a trusted platform for unauthorized execution, unauthorized VPN access, appliance control, security-policy manipulation, unauthorized administration, identity-boundary bypass, or identity-based expansion before containment.

Economic exposure rises when affected gateways, Windows RRAS servers, VPN services, or security-management platforms support privileged administrators, remote workforces, third-party vendors, business partners, domain authentication, identity providers, internal applications, firewall and security-policy administration, management systems, cloud resources, backup platforms, virtualization environments, storage systems, regulated services, or customer-facing operations. Exposure is highest when defenders cannot separate unsuccessful exploitation from successful appliance-local service access, validated RRAS service-host execution, unauthorized VPN-session establishment, unauthorized or pre-authentication Child SA establishment, root-level command execution, unauthorized SmartConsole authentication, application-token acquisition, configuration or hotfix manipulation, security-policy modification, policy publication or installation, active-session exposure, credential theft, service-account abuse, internal authentication, endpoint execution, or cloud-resource access.

Estimated Economic Exposure

Estimated exposure should be treated as scenario-based rather than fixed. The most defensible enterprise estimate depends on whether activity remains limited to internet exposure, vulnerable-state findings, suspicious requests, failed protocol upgrades, suspicious RRAS network activity, suspicious IKE negotiation, gateway errors, RRAS service faults, malformed strongSwan PKCS#7, EAP, X.509, IKEv1, or IKEv2 processing, attempted appliance-local access, unsuccessful SmartConsole authentication, or blocked management-server access; becomes suspected or confirmed gateway, RRAS, VPN, or security-management compromise; or expands into unauthorized service-context execution, unauthorized VPN-session establishment, unauthorized Child SA creation, identity-binding or authorization bypass, unauthorized administrative access, application-token use, security-policy modification, authentication-material exposure, session hijacking, service-account abuse, domain authentication, endpoint execution, internal expansion, cloud access, persistence, ransomware deployment, destructive activity, data exposure, enforcement-policy degradation, or multi-system trust loss.

CVE-2026-94127 adds a current F5 BIG-IP APM data-plane remote-code-execution exposure to this model. The documented condition requires an APM access policy and an OAuth profile on the same virtual server. Specific malicious traffic can permit unauthenticated remote code execution, including on Appliance-mode systems. F5 confirms exploitation in the wild. CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities Catalog on September 22, 2026. The confirmed exploitation state and KEV designation increase remediation, retrospective-hunting, and compromise-assessment urgency but do not independently establish compromise of a local BIG-IP APM deployment.

Citrix NetScaler ADC and NetScaler Gateway CVE-2026-88771 through CVE-2026-88778 add a current remote-access gateway exposure set to this model. Citrix confirms observed exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments. CVE-2026-88771 permits unauthenticated arbitrary command execution through improper input validation, while CVE-2026-88772 is a memory-overflow condition capable of remote code execution or denial of service when DTLS is enabled. The remaining vulnerabilities cover HTTP request smuggling, feature-policy bypass, memory-overflow denial-of-service conditions, and predictable TCP initial sequence numbers under affected configurations. Citrix-confirmed exploitation and CISA KEV designation materially increase remediation, retrospective-hunting, and compromise-assessment urgency but do not independently establish compromise of a local NetScaler deployment. CISA added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities Catalog on September 27, 2026, based on evidence of active exploitation.

CVE-2026-88779 adds a separate current Citrix NetScaler ADC and NetScaler Gateway exposure to this model. Citrix identifies the vulnerability as a memory overflow leading to denial of service when the appliance is configured as a SAML SP or SAML IdP. CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities Catalog on October 4, 2026, based on evidence of active exploitation. The KEV designation materially increases remediation and investigation urgency but does not change the Coverage With Adaptation classification or independently establish compromise of a local NetScaler deployment.

CVE-2026-102764 adds an actively exploited BeyondTrust Remote Support appliance-compromise exposure to this model. BeyondTrust identifies improper origin validation in an internal messaging component that can permit an unauthenticated remote attacker to perform unauthorized appliance file operations. Affected Remote Support releases include versions through 26.2.3. BeyondTrust deployed the corrective patch to its Remote Support SaaS environments on October 9, 2026, and provides the BT26-05-RS patch for supported self-hosted deployments, with earlier versions requiring an applicable upgrade. Google Threat Intelligence Group / Mandiant documents zero-day exploitation beginning in late August 2026 by ARMORY CASTLE, formerly UNC5221, a suspected PRC-nexus espionage actor. Documented post-exploitation procedures include SAWFLY PHP webshell deployment, BARECLAW SOCKS5-over-WebSocket tunneling, SUID-enabled privilege escalation, credential-vault access attempts, persistence, appliance configuration manipulation, administrative access abuse, remote-support session abuse, internal reconnaissance, lateral movement, and anti-forensic activity. Successful exploitation can undermine gateway integrity, expose privileged authentication material, and convert trusted remote-support infrastructure into an access path for downstream enterprise compromise. Confirmed campaign exploitation increases remediation, retrospective-hunting, and compromise-assessment urgency but does not independently establish compromise of a particular BeyondTrust deployment. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities Catalog on 16 October 2026, establishing KEV-confirmed status and reinforcing remediation and retrospective-investigation priority. The vulnerability remains Coverage With Adaptation because reliable identification requires BeyondTrust-specific product, version, messaging, file-operation, appliance, session, process, configuration, network, and forensic evidence beyond the existing S25 detection implementation.

CVE-2026-104935 adds an actively exploited Ivanti Connect Secure authentication-bypass and unauthenticated command-execution exposure to this model. The vulnerability affects specific Connect Secure release branches and permits an unauthenticated remote attacker to cross the appliance authentication boundary and execute arbitrary commands under the documented conditions. Ivanti confirms limited exploitation in the wild, and CISA added the vulnerability to the Known Exploited Vulnerabilities Catalog on October 13, 2026, with an October 16, 2026 remediation deadline. Successful exploitation may compromise gateway integrity, expose authentication material or active sessions, and enable downstream identity or infrastructure access. The exploitation and KEV evidence increase remediation, retrospective-hunting, and compromise-assessment urgency but do not independently establish successful exploitation of a particular deployment. The vulnerability remains Coverage With Adaptation because its initiating condition requires Ivanti-specific product, version, authentication, request, appliance-execution, and forensic evidence beyond the existing S25 detection families.

CVE-2026-107406 adds a separate critical Citrix NetScaler ADC and NetScaler Gateway memory-overflow exposure capable of remote code execution or denial of service. The vulnerability applies to affected appliances configured as a SAML service provider or SAML identity provider, subject to release-specific prerequisites. The remote-code-execution consequence creates potential for appliance compromise and downstream identity or infrastructure exposure beyond service availability loss. Current authoritative evidence reviewed for this amendment does not establish confirmed exploitation in the wild or CISA Known Exploited Vulnerabilities Catalog status for CVE-2026-107406. The vulnerability remains Coverage With Adaptation because its initiating condition requires Citrix-specific product, version, configuration, and appliance evidence beyond the existing S25 behavioral detections. Vulnerable-version state or SAML configuration alone does not establish successful exploitation.

Economic exposure increases when the organization cannot quickly determine whether suspicious activity remained limited to failed exploitation, whether externally sourced RRAS activity progressed to suspicious execution from the RemoteAccess service context, whether a proxy or WebSocket connection reached an appliance-local service, whether crafted Cisco Remote Access SSL VPN HTTP traffic caused an exploited device reload, whether suspicious Check Point IKE negotiation or authentication traffic established an unauthorized VPN session, whether suspicious strongSwan IKEv1 or IKEv2 traffic triggered only a service-impact condition or crossed an authentication or execution boundary, whether a strongSwan CREATE_CHILD_SA request established a usable Child SA before authentication completed, whether EAP identity propagation produced unauthorized identity binding or authorization, whether an authenticated strongSwan peer triggered a Multi-KE rekey use-after-free with execution consequences, whether suspicious IKE traffic caused exploitable Fireware iked memory corruption or only a crash or respawn, whether an unauthenticated actor obtained a valid application login token, whether unauthorized gateway or management-plane control occurred, whether security policies or configurations were modified, published, or installed, whether active sessions or authentication material were accessed, whether gateway-originated authentication was legitimate, whether endpoints or internal resources were reached, and whether RRAS service/process, VPN, gateway, management-server, SmartConsole, policy-change, VPN-session, identity, endpoint, network, cloud, change-control, and remediation evidence can be joined into a reliable sequence.

Low Impact Scenario

Estimated $500K - $3M

This scenario applies when rapid investigation confirms scanning, malformed requests, suspicious proxy or WebSocket activity, suspicious but non-impacting RRAS network activity, suspicious IKE negotiation, malformed strongSwan PKCS#7, certificate, EAP, X.509, or IKE traffic, attempted appliance-local access, attempted SmartConsole or management-server access, public exploit-like requests, gateway errors, RRAS service faults, Cisco appliance reload attempts, strongSwan crash, memory-leak, thread-blocking, memory-exhaustion, or service-restart activity without evidence of authentication-boundary bypass or execution, iked crash or respawn activity without evidence of successful code execution, vulnerable firmware or software, unrestricted Trusted Client exposure, or unsuccessful protocol upgrades without evidence of validated RRAS service-context execution, unauthorized VPN-session establishment, unauthorized Child SA establishment, identity-binding abuse, successful appliance-local connection, application-token acquisition, unauthorized administrative authentication, unauthorized gateway or management-plane control, security-policy modification, authentication-material exposure, gateway-originated authentication, endpoint execution, internal expansion, or cloud-resource access.

Available evidence supports a failed, contained, authorized, or non-impacting event. Response remains limited to patch and hotfix validation, Windows security-update validation, Cisco fixed-release validation, Check Point hotfix and remote-access configuration validation, OpenVPN remediation validation, strongSwan 6.1.0 or maintained-package remediation validation, Fireware update validation where applicable, management-server mitigation, Trusted Client restriction, evidence preservation, focused hunting, administrator and policy review, configuration review, credential precaution, short-term monitoring, and executive assurance that gateway, RRAS, VPN, security-management, policy-enforcement, and identity trust were not materially affected.

Moderate Impact Scenario

Estimated $5M - $35M

This scenario applies when confirmed or strongly suspected gateway, RRAS, VPN, or security-management compromise affects one or more production, privileged-access, identity-integrated, cloud-connected, centrally managed, or business-critical remote-access or security-management systems and suspicious external interaction aligns with successful appliance-local connection behavior, validated RemoteAccess service-context execution, unauthorized Check Point Remote Access or Mobile Access VPN-session establishment, unauthorized or pre-authentication strongSwan Child SA establishment, strongSwan identity-binding or authorization anomalies, suspicious authenticated-peer rekey activity with credible use-after-free or execution implications, suspicious Fireware iked activity with credible evidence of memory corruption or execution, unauthorized command execution, application-token acquisition, unauthorized SmartConsole authentication, unexpected administrator activity, security-policy or configuration modification, unexpected policy publication or installation, unexpected hotfix or configuration activity, unexplained gateway-originated authentication, unfamiliar service-account use, endpoint execution, internal discovery, or access to high-value systems.

The organization cannot immediately determine whether administrator credentials, directory-integration accounts, active sessions, authentication tokens, certificates, TOTP seeds, user credentials, security policies, trusted-client restrictions, managed gateways, RRAS host trust, VPN access state, strongSwan IKE or Child SA state, EAP-authenticated identity state, or downstream systems were exposed or manipulated.

Response may require gateway, RRAS, VPN, and management-server review; Cisco ASA/FTD SSL VPN and reload-event review; Check Point IKEv1, Remote Access, Mobile Access, VPN-session, authentication, and post-access review; strongSwan IKEv1/IKEv2, PKCS#7, X.509, EAP, plugin, Child SA, rekey, authentication, session, process, and service-health review; Fireware and iked state review where applicable; process and service reconstruction; request and configuration reconstruction; SmartConsole and administrator-session review; security-policy comparison; policy-publication and installation validation; VPN-session and identity correlation; credential and token rotation; certificate review; TOTP reset; endpoint investigation; internal-network analysis; cloud review; gateway, RRAS server, VPN service, or management-server rebuild or replacement; legal and compliance review; cyber-insurance coordination; executive reporting; and strengthened post-remediation monitoring.

High Impact Scenario

Estimated $40M - $200M+

This scenario applies when gateway, RRAS, VPN, or security-management compromise becomes an enterprise-impact event involving confirmed or strongly suspected unauthorized service-context execution, remote code execution within an exposed gateway daemon, unauthorized VPN-session establishment, pre-authentication creation of a usable Child SA, authorization bypass through identity-binding failure, authenticated-peer exploitation producing remote code execution, unauthorized administrative control, security-policy weakening, malicious rule insertion, enforcement-policy manipulation, application-token abuse, session hijacking, credential theft, TOTP-seed exposure, directory-service account abuse, domain authentication, privileged endpoint execution, lateral movement, cloud-resource access, administrative-system compromise, persistent access, ransomware deployment, destructive activity, data exposure, security-control bypass, or widespread service disruption.

The organization may need to treat gateway administrators, RRAS hosts, VPN users and sessions, strongSwan peers and Child SAs, EAP-authenticated identities, security-management administrators, remote users, directory-integration accounts, service accounts, active sessions, authentication tokens, multifactor material, trusted-client configurations, security policies, managed gateways, internal applications, privileged systems, cloud resources, and connected business services as exposed or untrusted until reliable evidence proves otherwise.

Response may require broad forensic investigation, emergency gateway, RRAS, VPN, or management-server isolation, remote-access suspension, emergency policy review, restoration of known-good security policy, credential and token rotation, certificate replacement, enterprise TOTP reset, account remediation, endpoint containment, cloud-role restriction, gateway, RRAS server, VPN service, or management-server replacement, production recovery, notification analysis, legal and privacy escalation, cyber-insurance engagement, communications planning, executive and board reporting, and formal restoration of gateway, RRAS, VPN, security-management, enforcement-policy, and identity trust.

Annualized Risk Exposure

Estimated $6M - $45M+ for materially exposed enterprise environments with recurring remote-access gateway, Windows RRAS, Cisco Remote Access SSL VPN, Check Point Remote Access or Mobile Access, OpenVPN, strongSwan IKE/VPN, Fireware IKE/VPN, or security-management exposure, privileged internal connectivity, internet-accessible remote-access services or management servers, unrestricted or insufficiently restricted Trusted Clients, legacy IKEv1 support, large remote-workforce dependency, directory-service integration, centralized security-policy administration, concentrated service-account use, incomplete appliance or RRAS process telemetry, weak VPN-session correlation, limited administrative logging, incomplete RemoteAccess service-process attribution, incomplete IKE/daemon-health visibility, incomplete strongSwan IKE SA and Child SA visibility, incomplete EAP identity correlation, incomplete SmartConsole attribution, unreliable source attribution, poor workstation-name capture, short telemetry retention, or broad downstream access.

Exposure may exceed $40M - $200M+ when suspected or confirmed gateway, RRAS, VPN, or security-management compromise results in unauthorized execution, unauthorized VPN-session establishment, pre-authentication Child SA establishment, authorization bypass, unauthorized administrative access, application-token abuse, security-policy manipulation, security-control weakening, credential theft, session hijacking, TOTP-seed exposure, directory-account abuse, domain authentication, privileged endpoint execution, cloud-resource access, lateral movement, persistent access, ransomware deployment, destructive activity, regulated-data exposure, widespread remote-access or enforcement-policy disruption, incomplete containment, legal escalation, communications response, cyber-insurance review, or board-level reporting.

Operational Dependency

Operational dependency is high where remote-access gateways, Windows RRAS servers, Cisco Secure Firewall ASA or FTD Remote Access SSL VPN services, Check Point Remote Access VPN or Mobile Access deployments, OpenVPN services, strongSwan VPN gateways, or associated security-management platforms support employees, privileged administrators, third-party vendors, business partners, customer support, production applications, identity services, centrally managed security gateways, firewall and access-control policy, cloud platforms, backup environments, virtualization infrastructure, storage systems, administrative networks, regulated services, or business-continuity operations.

Even one affected gateway, RRAS server, VPN gateway, strongSwan endpoint, or management server can create broad investigation and recovery requirements when it holds or brokers active sessions, IKE SAs, Child SAs, authentication state, integrates with privileged service accounts, controls multiple enforcement points, connects to multiple identity systems, supports a large user population, or can reach high-value internal and cloud resources.

Dependency increases when the affected gateway, RRAS server, VPN gateway, strongSwan endpoint, or management server cannot be isolated, failed over, patched, rebuilt, replaced, or removed from service without disrupting remote work, administrative access, vendor support, firewall or access-control administration, application delivery, regulated operations, or disaster-recovery capability. Dependency is highest when multiple gateway, RRAS, VPN, strongSwan, or management nodes share configuration, certificates, EAP infrastructure, service accounts, administrator objects, Trusted Client settings, authentication methods, management systems, security policies, or downstream trust relationships.

Gateway, RRAS, Management-Plane, and Remote-Access Trust

Gateway, RRAS, management-plane, and remote-access trust are reduced when the organization cannot prove that appliance, Windows service, host, VPN, strongSwan daemon, IKE SA, Child SA, EAP identity, or management-server configuration, routes, services, accounts, administrator objects, Trusted Client restrictions, remote-access authentication requirements, access rules, security policies, policy packages, published changes, installed policies, hotfix state, certificates, active sessions, credential stores, authentication integrations, logging, administrative access, and internal communication remained reliable during the activity window.

Trust is further reduced when suspicious external requests reference loopback, localhost, link-local, appliance-local, encoded, malformed, internal, or prohibited destinations; when suspicious externally sourced RRAS activity is followed by execution from a validated RemoteAccess service process; when crafted HTTP traffic against Cisco Remote Access SSL VPN aligns with unexpected ASA or FTD reload behavior; when unexpected Check Point IKEv1 Remote Access or Mobile Access sessions appear without the expected user-authentication or machine-certificate state; when strongSwan receives anomalous PKCS#7, certificate, EAP, X.509, IKEv1, IKEv2, rekey, or CREATE_CHILD_SA traffic followed by unexplained process impact, pre-authentication Child SA state, identity mismatch, authorization deviation, crash, memory exhaustion, undefined behavior, or execution; when suspicious IKE negotiation or authentication traffic aligns with iked crashes, respawns, memory-corruption indicators, unexpected service behavior, or subsequent appliance activity; when successful WebSocket, proxy, relay, application-token, or unauthorized SmartConsole authentication behavior is observed; when unauthorized command execution, administrator activity, policy modification, policy publication, policy installation, hotfix activity, route changes, service changes, configuration changes, or filesystem activity occurs; or when gateway-originated authentication or management-plane changes cannot be reconciled with approved VPN sessions, administrator activity, change-control records, or directory-service behavior.

For CVE-2026-94127, BIG-IP APM data-plane trust is reduced when a virtual server combines an APM access policy with an OAuth profile and suspicious unauthenticated traffic cannot be separated from ordinary OAuth and APM request processing, or when resulting process, memory, service, network, session, or downstream activity cannot be reconciled with expected behavior. F5 explicitly identifies this as a data-plane issue with no control-plane exposure, so the CVE should not be used by itself to claim management-plane compromise. Trust restoration requires installation of the applicable engineering hotfix, validation of affected virtual-server configuration, preservation and review of relevant request and appliance evidence, and compromise assessment where the vulnerable configuration was exposed before remediation.

F5 BIG-IP APM compromise creates an additional trust problem because the documented PoisonedRefresh implant can manipulate Apache and PHP at runtime while leaving the targeted PHP files unchanged on disk. Sophos describes a second-stage Linux implant that executes before normal application logic, hooks Apache Portable Runtime module loading, waits for libphp, patches file and memory-handling behavior inside the PHP runtime, and prepends a PHP web shell to the in-memory representation of legitimate BIG-IP APM webtop scripts. A separate local UNIX-domain-socket path can redirect authenticated input to /bin/bash without opening a TCP listening port. File-integrity checks or clean on-disk copies of the targeted PHP files therefore do not independently restore trust.

Visibility Confidence

Visibility confidence is highest when gateway web, proxy, relay, WebSocket, Cisco SSL VPN, IKE, VPN, OpenVPN, strongSwan, administrative, configuration, system, health, Windows RRAS service and process, VPN-session, IKE SA, Child SA, EAP-authentication, authentication, identity, endpoint, firewall, NDR, network-flow, DNS, cloud, management-server, SmartConsole, administrator-session, application-token, Trusted Client, policy-change, policy-publication, policy-installation, change-control, and incident-response telemetry can be correlated through stable gateway, RRAS host, RemoteAccess service-process, VPN gateway, strongSwan endpoint, management-server, node, interface, administrator, account, session, workstation, endpoint, destination, policy, managed-gateway, and cloud-resource mappings.

Visibility confidence is reduced when requested destinations are missing or encoded, appliance-local traffic is not visible, Cisco SSL VPN request and appliance-reload evidence is unavailable, Check Point IKEv1 negotiation and VPN-session attribution are incomplete, machine-certificate or legacy-client state cannot be reconstructed, OpenVPN telemetry is incomplete, strongSwan IKE SA, Child SA, plugin, EAP, certificate, PKCS#7, X.509, rekey, daemon-health, process, or authentication evidence is unavailable, Fireware IKE traffic or iked daemon-health evidence is unavailable, IKE diagnostic-logging state cannot be reconstructed where relevant, RRAS host identity is incomplete, RemoteAccess service-process attribution is missing or stale, process ancestry is unavailable, command-line telemetry is unavailable where needed for additional context, service faults or restarts cannot be reconstructed, administrative attribution is incomplete, SmartConsole sessions or application-token activity are unavailable, policy revisions cannot be reconstructed, Trusted Client configuration history is missing, appliance process and filesystem telemetry are unavailable, VPN-session records are missing, workstation names are unreliable, translated or shared addresses obscure attribution, clustered-node or management-domain mapping is incomplete, cloud activity cannot be tied to the gateway or account, or retention is insufficient to reconstruct the pre-remediation activity window.

S25 depends on validated gateway, RRAS, VPN, and management-asset mapping, requested-destination normalization, protocol and connection-result fields, RemoteAccess service-process attribution, process ancestry, administrative-event normalization, approved change records, VPN-session availability, service-account mapping, workstation-name baselines, endpoint network-to-process correlation, cloud-source attribution, approved exceptions, and bounded-time correlation.

RRAS coverage additionally depends on confirmed RRAS host identity, externally sourced network telemetry, current RemoteAccess service-process mapping, process-creation telemetry, and parent-child process context.

Coverage of CVE-2026-102764 additionally depends on BeyondTrust Remote Support product and exact-version validation; confirmation of the applicable appliance deployment and pre-remediation exposure window; internal messaging and file-operation evidence where available; relevant appliance web, reverse-proxy, process, filesystem, configuration, administrative, and support-session activity; privileged-execution and persistence evidence; credential-vault access records; outbound and internal network telemetry; and incident-response findings sufficient to distinguish vulnerable-state, unsuccessful exploitation attempts, authorized administrative operations, and successful appliance compromise. SAWFLY and BARECLAW introduce additional artifact-identification opportunities when relevant files, memory, or forensic collections are accessible. Published YARA signatures can support identification of those artifacts but are not behavioral detections and do not independently establish exploitation, execution, persistence, tunneling activity, or compromise. Existing behavioral S25 detections may identify consequential command execution, appliance modification, credential access, persistence, suspicious network communication, unauthorized administration, internal expansion, or downstream identity activity when observable, but they do not independently identify the initiating CVE-2026-102764 condition.

Coverage of CVE-2026-104935 additionally depends on Ivanti Connect Secure product identification and exact release-branch validation; confirmation of the affected authentication-bypass exposure; relevant inbound authentication, gateway-request, and session evidence; appliance process and command-execution telemetry; configuration and filesystem activity; outbound network behavior; downstream identity and infrastructure access; and incident-response findings sufficient to distinguish vulnerable-state, unsuccessful exploitation attempts, ordinary appliance administration, and successful unauthorized execution. The affected release boundaries include applicable vulnerable versions within the 22.8, 25.1.2, and 25.1.1 branches, while the 22.7 branch is identified as unaffected. Existing S25 behavioral detections may identify consequential gateway compromise, unauthorized command execution, identity misuse, internal expansion, or downstream access when observable but do not independently identify the CVE-2026-104935 authentication-bypass condition. Ivanti-confirmed exploitation and CISA KEV status increase investigation urgency without replacing local compromise evidence.

Coverage of CVE-2026-107406 additionally depends on Citrix NetScaler ADC or NetScaler Gateway product and exact-version validation; confirmation of applicable SAML SP or SAML IdP configuration prerequisites; relevant inbound SAML, authentication, and gateway-request evidence; appliance process, memory, execution, and service-health telemetry; crash or restart evidence; outbound network behavior; downstream identity or infrastructure activity; and incident-response findings sufficient to distinguish vulnerable-state, ordinary SAML processing, or operational service instability from successful exploitation. Existing S25 detections may identify consequential execution, gateway compromise, identity misuse, internal expansion, or other downstream activity when observable but do not independently identify the CVE-specific memory-overflow condition.

Coverage of CVE-2026-94127 additionally depends on F5 BIG-IP APM product and exact-version context; confirmation that an APM access policy and an OAuth profile are configured on the same virtual server; inbound request and OAuth-processing evidence where retained; TMM, Apache, process, memory, service, network, appliance, and incident-response evidence; and sufficient correlation to distinguish vulnerable-state or ordinary OAuth and APM traffic from successful unauthenticated remote code execution. F5 states that Appliance mode is also vulnerable and that this is a data-plane vulnerability with no control-plane exposure. F5-confirmed exploitation and CISA KEV status increase remediation and compromise-assessment urgency but do not replace local compromise evidence or change the Coverage With Adaptation classification.

Coverage of CVE-2026-78626 additionally depends on Okta Access Gateway product and version context; confirmation that a Protected Rule is configured on an application resource; authenticated application-user identity and privilege context; relevant request, input, authorization, and protected-resource evidence; downstream application-access evidence; and incident-response findings sufficient to distinguish authorized application access from exploitation of the authorization-bypass condition. Affected versions are before 2026.9.1. Okta reports no known exploitation.

Coverage of CVE-2025-53521 additionally depends on F5 BIG-IP APM product and exact-version context; confirmation that an APM access policy is configured on an affected virtual server; relevant inbound request, TMM, Apache, PHP, process, memory, filesystem, service, network, and incident-response evidence; integrity comparison of /usr/sbin/httpd and applicable BIG-IP upgrade images; runtime evidence involving libphp, /proc/self/maps, memory-protection changes, or the /run/bigtlog.pipe UNIX socket where available; and sufficient temporal correlation to distinguish vulnerable-state or ordinary BIG-IP webtop activity from exploitation and post-exploitation persistence. CISA KEV status and F5-confirmed exploitation increase urgency but do not replace local evidence.

Coverage of CVE-2026-50751 additionally depends on affected Security Gateway and version validation, Remote Access VPN or Mobile Access configuration, IKEv1 use, legacy-client acceptance, machine-certificate requirements, IKE and VPN-session evidence, authentication and identity context, source and destination attribution, downstream activity, hotfix and configuration history, and incident-response validation.

Coverage of CVE-2026-20349 additionally depends on affected ASA or FTD validation, Remote Access SSL VPN or applicable listening configuration, request and network evidence, device-health and reload records, availability evidence, and incident-response validation.

Coverage of the OpenVPN 2.7.7 vulnerability set additionally depends on OpenVPN platform, package and version inventory, service mode, configuration and validation-script context, CA and certificate evidence, path and file provenance, process and command-line telemetry, service-control and IPC visibility, tapctl and netsh.exe context where applicable, NRPT and DHCP option evidence where applicable, tunnel and connection telemetry, fault or crash/restart evidence, authentication and session context, and downstream network evidence.

Coverage of the strongSwan 6.1.0 vulnerability set additionally depends on strongSwan platform, package and version inventory; IKEv1 and IKEv2 enablement; loaded plugin state; PKCS#7 and certificate-processing context; X.509 attribute-certificate handling; EAP-AKA, EAP-PEAP, and EAP-TTLS configuration where applicable; EAP identity and authenticated-user context; IKE SA and Child SA state; CREATE_CHILD_SA activity; Multi-KE and rekey state; peer-authentication status; service-health, memory-pressure, crash, restart, and process evidence; network and IKE telemetry; and incident-response findings sufficient to distinguish vulnerable-state or benign protocol handling from exploitation.

Coverage of CVE-2026-16232 additionally depends on local availability of Check Point management-server, SmartConsole, administrator-login, application-token, Trusted Client, security-policy, policy-publication, policy-installation, and managed-gateway telemetry.

Reliable attribution of WatchGuard iked exploitation additionally requires Fireware product and version context, IKE network and protocol evidence, iked daemon health or crash/respawn evidence, diagnostic-logging configuration where applicable, appliance system evidence, and incident-response validation.

Coverage of CVE-2025-14733 additionally depends on affected Fireware OS product and version context; mobile-user VPN using IKEv2 or branch-office VPN using IKEv2 with a dynamic gateway peer; historical configuration state where WatchGuard's documented stale-configuration condition may apply; IKE network and protocol evidence; iked daemon-health, crash/respawn, memory-corruption, or execution evidence where available; appliance system and network evidence; downstream activity; and incident-response findings sufficient to distinguish vulnerable-state, ordinary IKE activity, or operational daemon instability from exploitation. CISA's known-ransomware-campaign-use designation increases urgency but does not replace local compromise evidence.

S25 does not depend on CVE strings, exploit names, actor names, malware names, source-IP reputation, fixed URI paths, hashes, filenames, vulnerable firmware or software versions, or isolated KEV status.

Credential, Session, and Authentication-Material Dependency

Credential and authentication-material dependency is high when affected gateways, RRAS servers, VPN gateways, strongSwan endpoints, or management platforms can access, broker, or store administrator credentials, directory-integration accounts, LDAP credentials, service accounts, active sessions, IKE identities, EAP identities, application login tokens, cookies, authentication tokens, certificates, VPN context, multifactor records, TOTP seed material, user credentials, API credentials, security-policy credentials, or privileged-access information.

Dependency becomes materially higher when affected accounts, tokens, gateways, RRAS hosts, VPN sessions, strongSwan IKE SAs or Child SAs, or management platforms can authenticate to domain controllers, identity providers, managed security gateways, management platforms, backup systems, virtualization infrastructure, storage systems, cloud resources, or regulated applications without a second interactive approval step; when an authentication bypass creates an apparently valid VPN session without expected credentials; when a Child SA becomes usable before authentication completes; when identity binding allows one authenticated client to obtain authorization or network state associated with another identity; when sessions or tokens remain valid after remediation; when credentials are reusable across environments; when unauthorized management access can modify centrally enforced security policy; or when rotation, revocation, replacement, policy restoration, VPN-session invalidation, Child SA termination, and reset evidence is incomplete.

Identity and Internal Infrastructure Dependency

Identity and internal infrastructure dependency is high when gateways, RRAS servers, VPN gateways, strongSwan endpoints, or management platforms communicate with domain controllers, LDAP services, Kerberos infrastructure, NTLM services, SMB resources, identity providers, RADIUS or EAP infrastructure, certificate services, privileged-access platforms, administrative systems, management servers, managed security gateways, backup environments, virtualization systems, storage platforms, jump hosts, or high-value applications.

The organization must distinguish expected gateway- or RRAS-originated authentication, authorized remote-access VPN establishment, expected strongSwan IKE/EAP identity state, authorized Child SA creation, and approved management-plane administration from identity or policy abuse. Service-account use, administrator-login deviations, application-token creation or use, unexpected VPN sessions, unexpected Child SAs, EAP outer/inner identity mismatches, workstation-name deviations, authentication without an authorized VPN or management session, unusual protocols, new destinations, failed-to-success sequences, suspicious RemoteAccess service-context execution, security-policy changes, policy publication, policy installation, and gateway-originated access to high-value systems become materially relevant only when telemetry ties them to the affected appliance, RRAS host, VPN gateway, strongSwan endpoint, service process, management server, administrator, account, session, source, destination, policy object, managed gateway, or investigation window.

Cloud and Multi-Environment Dependency

Cloud dependency is high when affected gateways, RRAS servers, VPN gateways, strongSwan endpoints, or management platforms provide access to AWS, Azure, or Google Cloud applications, management planes, identity systems, storage resources, backup services, administrative functions, production workloads, or cloud-connected security controls.

The organization must distinguish ordinary hybrid-cloud access and approved security-policy administration from activity resulting from exposed sessions, authentication-bypass-created VPN sessions, pre-authentication Child SAs, identity-binding failures, credentials, tokens, certificates, service accounts, trusted gateway addresses, compromised RRAS execution context, unauthorized SmartConsole access, or compromised management-plane control. Cloud sign-ins, API actions, role use, storage access, backup access, remote commands, identity changes, policy changes, security-control changes, or management activity become materially relevant only when telemetry links them to the affected gateway, RRAS server, VPN gateway, strongSwan endpoint, management server, administrator, account, source address, user agent, session, token, policy, resource, or bounded time window.

Customer, Partner, Workforce, and Regulatory Exposure

Customer, partner, workforce, and regulatory exposure increases when suspected gateway, RRAS, VPN, or security-management compromise affects remote employees, privileged administrators, third-party vendors, business partners, regulated applications, identity systems, centrally administered security controls, production services, customer-facing operations, cloud platforms, backup infrastructure, administrative networks, or systems holding sensitive credentials and data.

Exposure also increases when telemetry gaps prevent timely confirmation of whether RRAS service-context execution occurred, whether Cisco CVE-2026-20349 exploitation caused an expected or attacker-induced gateway reload, whether Check Point CVE-2026-50751 produced unauthorized VPN-session establishment or subsequent internal access, whether a strongSwan vulnerability produced only availability impact or resulted in usable pre-authentication Child SA establishment, authorization bypass, or remote execution, whether WatchGuard iked exploitation progressed beyond service crash or respawn into remote code execution, whether unauthorized administrative access occurred, whether security policies were modified, active sessions were hijacked, credentials or application tokens were used, TOTP material was exposed, internal systems were accessed, cloud resources were affected, customer or partner services were disrupted, regulated data was exposed, enforcement controls were weakened, or containment was complete.

Residual Economic Risk

Residual economic risk remains after patching, Windows security-update deployment, Cisco fixed-release or hotfix deployment, Check Point hotfix deployment and IKEv1 remote-access remediation, OpenVPN update deployment, strongSwan 6.1.0 or maintained-package remediation, Fireware update deployment, SonicWall platform-hotfix deployment, management-server mitigation, Trusted Client restriction, rebooting, failover, configuration restoration, security-policy restoration, gateway, RRAS, VPN, or management-server isolation, credential rotation, session revocation, application-token invalidation, certificate replacement, TOTP reset, gateway, RRAS, VPN, or management-server rebuild, or incident-response cleanup when the pre-remediation activity window cannot be reconstructed.

For CVE-2026-102764, remediation should include identifying affected BeyondTrust Remote Support deployments, validating exact appliance versions and deployment type, and installing the applicable BT26-05-RS correction or confirming vendor-applied SaaS remediation. BeyondTrust identifies affected Remote Support versions through 26.2.3 and reports that Remote Support SaaS deployments received the corrective patch on October 9, 2026. Supported self-hosted versions require the applicable vendor patch, while earlier versions require an upgrade before patch installation. BeyondTrust additionally recommends precautionary Privileged Remote Access patching because of shared affected code, while stating that its testing has not identified an exploitable Privileged Remote Access path. Because Mandiant documents zero-day exploitation beginning in late August 2026, affected organizations should investigate the historical exposure window rather than relying solely on current patch state. Historical appliance file operations, web and reverse-proxy activity, process execution, SUID-related privilege changes, filesystem modifications, startup scripts, sudoers templates, HAProxy configuration, credential-vault access, administrative permissions, remote-support sessions, outbound tunneling, internal connections, log deletion, and downstream identity activity should be reviewed where relevant. Applying the corrective patch reduces future exploitability but does not independently establish that pre-remediation appliance compromise, SAWFLY deployment, BARECLAW execution, privileged access, credential exposure, persistence, lateral movement, or other downstream activity did not occur. Published SAWFLY and BARECLAW YARA signatures may assist artifact-based forensic investigation when suitable collections are available but should not be interpreted as behavioral detection coverage or proof that a deployment was compromised.

For CVE-2026-104935, remediation should include identifying affected Ivanti Connect Secure deployments, validating exact product and release-branch exposure, and installing the applicable vendor-corrected release. Ivanti identifies 22.7R2.14, 22.8R2.5, 25.1.3.0, and 25.1.3.1 as unaffected releases, subject to product-specific and branch-specific applicability. Because Ivanti confirms limited exploitation in the wild and CISA added CVE-2026-104935 to KEV on October 13, 2026, affected organizations should prioritize remediation and perform compromise assessment covering the pre-remediation exposure window. Applying a corrected release reduces future exploitability but does not independently prove that authentication bypass, unauthorized command execution, appliance modification, credential or session exposure, persistence, internal access, or downstream identity abuse did not occur before remediation. Historical gateway requests, authentication activity, appliance process and filesystem evidence, configuration changes, network connections, sessions, downstream identity activity, and incident-response findings should be reviewed where relevant. CISA's October 16, 2026 remediation deadline increases operational urgency but does not independently establish local compromise.

For CVE-2026-107406, remediation should include identifying affected NetScaler ADC and NetScaler Gateway deployments, validating exact appliance versions and SAML SP or SAML IdP configuration, and applying the applicable Citrix corrected release. Corrected releases include NetScaler ADC and Gateway 14.1-73.46 and 13.1-64.29, NetScaler ADC FIPS 14.1-73.46, and NetScaler ADC FIPS / NDcPP 13.1-37.283 or later. The documented configuration prerequisites vary by affected release. Applying the corrected version reduces future exploitability but does not independently establish that remote code execution, service disruption, appliance compromise, credential or session exposure, unauthorized network activity, or downstream identity access did not occur before remediation. Historical SAML, authentication, gateway-request, process, memory, service-health, crash or restart, appliance, network, and incident-response evidence should be reviewed where the vulnerable configuration was present.

For CVE-2026-94127, remediation should include installing the applicable F5 engineering hotfix and validating every BIG-IP APM virtual server where an APM access policy and an OAuth profile are configured together. Affected supported branches include BIG-IP 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, 17.5.x before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and 17.1.x before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. F5 states that the BIG-IP system in Appliance mode is also vulnerable and that this is a data-plane issue with no control-plane exposure. F5 has confirmed exploitation in the wild, and CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities Catalog on September 22, 2026. Applying the hotfix or temporary vendor mitigation reduces future exploitability but does not independently prove that pre-remediation remote code execution, process or memory compromise, credential or session exposure, internal access, persistence, or other downstream activity did not occur. Historical request, OAuth, TMM, process, memory, service, network, appliance, and incident-response evidence should be reviewed where the vulnerable configuration was present.

For CVE-2026-78626, remediation should include upgrading Okta Access Gateway to version 2026.9.1 or later and reviewing environments where a Protected Rule is configured on an application resource. The vulnerability allows an authenticated low-privilege application user to bypass authorization under affected conditions. Applying the corrected version does not independently prove that unauthorized protected-resource access did not occur before remediation. Historical application-user, request, authorization, protected-resource, downstream-access, and incident-response evidence should be reviewed where the vulnerable configuration was present. Okta reports no known exploitation, and current authoritative evidence does not establish CISA KEV status.

For CVE-2025-53521, remediation should not stop at deployment of an F5 fixed release. F5 reclassified the BIG-IP APM condition as unauthenticated remote code execution on March 27, 2026 and confirmed exploitation. CISA added CVE-2025-53521 to the Known Exploited Vulnerabilities Catalog on March 27, 2026. The affected condition exists when a BIG-IP APM access policy is configured on a virtual server and specific malicious traffic reaches an affected version. Fixed release boundaries include BIG-IP 17.5.1.3, 17.1.3, 16.1.6.1, and 15.1.10.8 according to the applicable branch.

The September PoisonedRefresh analysis materially increases compromise-assessment requirements because the implant can infect /usr/sbin/httpd, modify SELinux-related configuration, persist into BIG-IP upgrade images, execute before normal Apache application logic, hook apr_dso_load, alter libphp runtime behavior, inject a PHP web shell into memory without requiring the final malicious PHP content to exist on disk, and expose a local UNIX-domain-socket path capable of redirecting a connection to /bin/bash. Applying the fixed BIG-IP release therefore does not independently prove that pre-remediation root-level execution, Apache or PHP runtime tampering, in-memory web-shell access, local shell access, upgrade-image persistence, credential or session exposure, internal access, or other downstream activity did not occur. Affected organizations should follow F5 compromise-assessment guidance and preserve relevant appliance, memory, process, filesystem, network, web, configuration, and incident-response evidence before destructive remediation where practicable.

For CVE-2026-50751, remediation should not stop at application of the Check Point hotfix. Check Point identifies the vulnerability as an authentication bypass in Remote Access VPN and Mobile Access deployments using deprecated IKEv1 key exchange under the applicable legacy-client and certificate-validation conditions. Check Point observed exploitation beginning May 7, 2026 and reported increased activity in early June. CISA added CVE-2026-50751 to the Known Exploited Vulnerabilities Catalog in June 2026. Affected organizations should apply the vendor hotfix, remove or restrict the vulnerable IKEv1 remote-access path where operationally feasible, validate machine-certificate and legacy-client settings, review historical VPN-session and IKE authentication evidence, and investigate downstream access associated with suspicious sessions. Remediation does not independently prove that unauthorized VPN access, internal discovery, credential use, payload retrieval, lateral movement, data access, ransomware preparation, or other post-compromise behavior did not occur before remediation.

Check Point reports that exploitation affected a limited number of organizations and that one incident involved confirmed post-compromise activity associated with a Qilin ransomware affiliate. Check Point assesses with medium confidence that the observed threat actor was financially motivated and associated with Qilin-related activity. This increases compromise-assessment and ransomware-hunting urgency but does not establish Qilin attribution for every exploitation attempt or every affected environment.

For CVE-2026-20349, Cisco states that PSIRT became aware of active exploitation in August 2026, and CISA added the vulnerability to the Known Exploited Vulnerabilities Catalog on August 11, 2026. The vulnerability permits an unauthenticated remote attacker to send crafted HTTP traffic to an affected Remote Access SSL VPN service and cause an unexpected device reload and denial-of-service condition. Applying a Cisco fixed release reduces future exploitability but does not independently prove that prior attacker-triggered reloads, availability disruption, associated reconnaissance, or other suspicious activity did not occur. Historical SSL VPN request, device-health, reload, crash, network, configuration, and incident-response evidence should be reviewed where an affected service was exposed.

For SonicWall SMA1000 CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, and CVE-2026-102258, remediation should include upgrading affected appliances to 12.4.3-03670, 12.5.0-03082, or a later applicable platform hotfix. CVE-2026-102255 is a pre-authentication SSRF condition in the SMA1000 Work Place interface that can allow an unauthenticated remote attacker to cause the appliance to issue requests and reach internal functionality. CVE-2026-102256 is a post-authentication OS-command-injection condition that can permit an authenticated administrator to execute arbitrary OS commands. CVE-2026-102257 is a Zip Slip condition in the Appliance Management Console that can allow specially crafted archive content to be extracted outside the intended destination and result in remote code execution. CVE-2026-102258 is a post-authentication stored cross-site-scripting condition in the Appliance Management Console. SonicWall states that there is currently no evidence that vulnerabilities addressed in this release are being exploited in the wild. Applying the corrected platform hotfix reduces future exploitability but does not independently establish that unauthorized requests, internal-function access, command execution, archive extraction, administrative-interface abuse, or downstream activity did not occur before remediation.

For SonicWall SMA1000 CVE-2026-83548 and CVE-2026-83549, remediation should not stop at installation of the corrected platform hotfix. SonicWall identifies affected SMA 1000 models 6210, 7210, and 8200v across impacted 12.4.3-03453 and 12.5.0-02835 platform-hotfix lines and identifies 12.4.3-03526 and 12.5.0-02952 as corrected versions. Because SonicWall reports active exploitation in the wild and CISA added both CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities Catalog on September 2, 2026, affected organizations should apply the corrected hotfix immediately and perform the vendor-directed compromise assessment. Where compromise indicators are identified, response may require hardware re-imaging or virtual-appliance redeployment, user and administrator password changes, and TOTP reset.

For the OpenVPN 2.7.7 vulnerability set, affected scope reaches OpenVPN 2.6 releases through 2.6.22 and the 2.7 development line through 2.7.6, subject to CVE-specific lower-version boundaries, platform requirements, service-mode conditions, and configuration qualifications. Remediation should include deployment of OpenVPN 2.7.7 or the maintained distribution or vendor security build appropriate to the environment. Applying the fixed release does not establish that pre-remediation command execution, unauthorized configuration use, service disruption, malformed network-configuration processing, binary planting, or related downstream activity did not occur.

For the strongSwan 6.1.0 vulnerability set, remediation should include deployment of strongSwan 6.1.0 or the maintained vendor or distribution security build appropriate to the environment. The eleven vulnerabilities span PKCS#7 processing, certificate enumeration, EAP-AKA error handling, IKE-message stringification, encrypted PKCS#7 processing, X.509 attribute-certificate validation and parsing, IKEv2 Multi-KE rekey collision handling, EAP-PEAP/EAP-TTLS identity propagation, and CREATE_CHILD_SA handling on unestablished IKE SAs. The affected lower-version boundaries vary by CVE from strongSwan 4.1.2 through 6.0.0. Applying the corrected release does not establish that pre-remediation denial of service, unauthorized Child SA establishment, identity-binding or authorization abuse, authenticated-peer use-after-free, or remote execution did not occur.

CVE-2026-78133 is the highest execution-impact condition in the September 7 strongSwan set. The flaw affects strongSwan 6.0.0 and newer and involves IKEv2 rekey collisions with multiple key exchanges. A use-after-free can occur during collision handling and may potentially be exploited for remote code execution by an authenticated peer. Remediation does not independently prove that pre-remediation anomalous rekey behavior, daemon instability, undefined behavior, or execution did not occur.

CVE-2026-78134 affects strongSwan 4.5.0 and newer and involves propagation of authentication details from inner EAP methods when EAP-PEAP or EAP-TTLS is used. The condition can produce incorrect identity binding and potential authorization bypass. An attacker must successfully authenticate with valid credentials, but affected configurations may allow one authenticated identity to obtain authorization state, uniqueness effects, or virtual-IP behavior associated with another identity. Historical EAP identity, IKE identity, VPN-session, virtual-IP, authorization, authentication-server, and downstream-access evidence should be reviewed when exposure is relevant.

CVE-2026-78135 affects strongSwan 5.9.7 and newer and involves CREATE_CHILD_SA requests received on unestablished IKE SAs. The flaw can permit an unauthenticated peer to potentially establish a usable Child SA before authentication completes. Historical IKE_SA_INIT, IKE_AUTH, CREATE_CHILD_SA, Child SA, tunnel, source, destination, authentication, network-flow, firewall, and downstream-access evidence should be reviewed where the vulnerable service was exposed.

For CVE-2025-14733, remediation should not stop at Fireware OS update deployment. WatchGuard identifies the vulnerability as a critical out-of-bounds write in the Fireware OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code. Documented exposure includes mobile-user VPN using IKEv2 and branch-office VPN using IKEv2 with a dynamic gateway peer. WatchGuard also documents a stale-configuration condition under which a Firebox can remain vulnerable after those specific configurations are removed if a branch-office VPN to a static gateway peer remains configured. Affected default branches include Fireware OS versions >=2025.1 and <2025.1.4, >=12.0 and <12.11.6, and >=11.10.2 through 11.12.4+541730. Applicable corrected releases are 2025.1.4 or later, 12.11.6 or later, and releases later than 11.12.4+541730 for the legacy branch.

CISA's current Known Exploited Vulnerabilities record identifies CVE-2025-14733 as used in known ransomware campaigns. This materially increases remediation, compromise-assessment, and retrospective-hunting urgency. Applying a corrected Fireware release does not independently prove that pre-remediation exploitation, iked memory corruption, unauthorized execution, credential or configuration exposure, internal access, persistence, or ransomware-enabling activity did not occur. Current authoritative evidence does not identify a specific ransomware family, and ransomware-family attribution should not be inferred solely from CVE-2025-14733 exploitation or KEV status.

Applying a firmware, operating-system, platform, OpenVPN, strongSwan, Cisco, Check Point, Okta Access Gateway, or management-server update reduces future exploitability but does not prove that appliance-local access, suspicious RRAS service-context execution, unauthorized VPN-session establishment, unauthorized protected-resource access, unauthorized strongSwan Child SA establishment, identity-binding or authorization abuse, successful OpenVPN command or configuration execution, successful strongSwan use-after-free or execution, successful iked memory-corruption exploitation, application-token acquisition, unauthorized SmartConsole authentication, administrative control, security-policy modification, policy publication or installation, command execution, configuration manipulation, session access, credential exposure, gateway-originated authentication, endpoint execution, cloud activity, persistence, ransomware preparation, or internal expansion did not occur before remediation.

Residual risk should remain elevated until historical gateway, RRAS service/process, VPN-session, IKE negotiation and authentication, OpenVPN service/process and configuration where applicable, strongSwan service/process, plugin, IKE SA, Child SA, EAP identity, PKCS#7, X.509, authentication and rekey evidence where applicable, Okta Access Gateway application-access and authorization evidence where applicable, Cisco SSL VPN and device-health, management-server, SmartConsole, administrator, application-token, Trusted Client, security-policy, configuration, session, identity, endpoint, network, cloud, change-control, incident-response, and remediation evidence has been reviewed.

Proof-of-Concept Behavioral Coverage Assessment

The existing S25 RRAS detections provide a reusable behavior model for network-reachable Windows Routing and Remote Access Service remote-code-execution vulnerabilities. The defining detection path is externally sourced network activity against a confirmed RRAS host followed by suspicious child-process execution from a process positively attributed to the RemoteAccess service. Current Microsoft and NVD records show this RRAS RCE class repeatedly across 2023-2026, including heap-based buffer overflows, integer-overflow or wraparound conditions, untrusted-pointer conditions, and other memory-safety defects that permit code execution over a network.

CVE-2026-26111, CVE-2026-25173, CVE-2026-25172, and CVE-2026-20868 are directly covered at the behavioral level when exploitation produces the S25-visible external-network-to-RemoteAccess-service execution sequence. Direct coverage does not mean that the S25 rule identifies which of these CVEs was used or guarantees detection of memory-only exploitation.

The same coverage object applies to the documented network-reachable RRAS RCE family from 2025, including CVE-2025-64678, CVE-2025-62549, CVE-2025-62452, CVE-2025-54113, CVE-2025-50164, CVE-2025-50163, CVE-2025-49670, CVE-2025-49669, CVE-2025-48824, CVE-2025-33066, CVE-2025-33064, CVE-2025-24051, CVE-2025-21410, and CVE-2025-21208 when the required RRAS service/process telemetry is available.

The S25 RRAS behavior model also applies to the network-reachable 2024 RRAS RCE family, including CVE-2024-49125, CVE-2024-49102, CVE-2024-49089, CVE-2024-49086, CVE-2024-49085, CVE-2024-43611, CVE-2024-43607, CVE-2024-43593, CVE-2024-43564, CVE-2024-43549, CVE-2024-43453, CVE-2024-38265, CVE-2024-38212, CVE-2024-38154, CVE-2024-38130, CVE-2024-38121, CVE-2024-30029, CVE-2024-30024, CVE-2024-30022, CVE-2024-30015, CVE-2024-30014, CVE-2024-30009, CVE-2024-26205, CVE-2024-26200, and CVE-2024-26179.

CVE-2023-35365, CVE-2023-35366, and CVE-2023-35367 are earlier Windows RRAS RCEs within the same network-reachable behavior family and are directly covered where exploitation produces the observable S25 execution sequence.

CVE-2024-30094 and CVE-2024-30095 are excluded from this Direct Coverage expansion because their Microsoft CNA attack vectors are local rather than network-based. Their documented access path does not directly satisfy the externally sourced network component implemented by the S25 RRAS rules.

CVE-2026-102764 is Coverage With Adaptation because its defining BeyondTrust Remote Support condition involves improper origin validation in internal messaging functionality that can permit unauthorized appliance file operations by an unauthenticated remote attacker. Reliable vulnerability-specific identification requires BeyondTrust product and exact-version context, affected appliance exposure, relevant internal messaging and file-operation evidence where available, appliance process and filesystem telemetry, configuration history, administrative and support-session records, network activity, downstream access, and incident-response findings beyond the existing S25 implementation. The associated ARMORY CASTLE intrusion procedures include deployment of the SAWFLY PHP webshell and BARECLAW SOCKS5-over-WebSocket tunneler, SUID-enabled privilege escalation, credential-vault access attempts, persistence through appliance configuration and startup mechanisms, administrative manipulation, remote-support session abuse, internal reconnaissance, lateral movement, and log deletion. Existing S25 behavioral detections can represent consequential appliance modification, unexpected execution, privileged activity, credential access, network tunneling, internal expansion, identity misuse, persistence, or downstream effects when observable, but they do not independently identify the initiating BeyondTrust vulnerability or establish ARMORY CASTLE attribution. Google-published SAWFLY and BARECLAW YARA signatures identify artifact characteristics rather than behavioral execution sequences and require access to relevant forensic material. Confirmed exploitation and CISA's 16 October 2026 addition of CVE-2026-102764 to the Known Exploited Vulnerabilities Catalog increase remediation and retrospective-investigation urgency without changing the Coverage With Adaptation classification or independently proving compromise of a local appliance.

CVE-2026-104935 is Coverage With Adaptation because its defining Ivanti Connect Secure behavior involves authentication bypass by spoofing that can permit unauthenticated remote command execution against affected appliance releases. Reliable vulnerability-specific identification requires Ivanti Connect Secure product and exact-version context, affected authentication-boundary validation, inbound request and authentication evidence, appliance process and command-execution telemetry, configuration and filesystem activity, network evidence, downstream identity or infrastructure access, and incident-response findings beyond the existing S25 implementation. Existing S25 detections can represent consequential gateway compromise, unexpected execution, unauthorized authentication, internal expansion, cloud access, persistence, or downstream activity when observable but do not directly identify the initiating Ivanti vulnerability. Ivanti confirms limited exploitation in the wild, and CISA added CVE-2026-104935 to KEV on October 13, 2026. These authoritative exploitation-state findings increase remediation and compromise-assessment urgency but do not change the Coverage With Adaptation classification, justify a new generic S25 detection family, or independently prove local compromise.

CVE-2026-107406 is Coverage With Adaptation because its defining Citrix NetScaler behavior involves memory overflow capable of remote code execution or denial of service under affected SAML SP or SAML IdP configurations. Reliable vulnerability-specific identification requires NetScaler product and exact-version context, release-dependent SAML configuration validation, inbound SAML and authentication evidence, appliance process and memory telemetry, service-health and crash or restart evidence, command or process execution where observable, network activity, downstream access, and incident-response findings. Existing S25 detections can represent consequential gateway compromise, unexpected execution, identity use, internal expansion, or cloud activity when observable but do not directly identify the CVE-2026-107406 initiating condition. The vulnerability therefore does not require a new generic S25 detection family.

CVE-2026-94127 is Coverage With Adaptation because its defining F5 BIG-IP APM behavior is unauthenticated remote code execution through a heap-based buffer overflow when an APM access policy and an OAuth profile are configured on the same virtual server. Reliable local attribution requires F5-specific product, exact-version, virtual-server, APM-policy, OAuth-profile, request, TMM, process, memory, service, network, appliance, and incident-response context beyond the current RRAS, SonicWall, WatchGuard, OpenVPN, strongSwan, Cisco, Check Point, or existing F5 CVE-2025-53521-focused implementations. F5 states that Appliance mode is also vulnerable and that the issue is a data-plane vulnerability with no control-plane exposure. F5-confirmed exploitation and CISA KEV status materially increase remediation and compromise-assessment urgency but do not make the current S25 implementation CVE-specific, change the Coverage With Adaptation classification, or independently prove local compromise.

CVE-2026-78626 is Coverage With Adaptation because its defining Okta Access Gateway behavior is an authorization bypass affecting a configured Protected Rule. Exploitation requires an affected version before 2026.9.1 and an authenticated low-privilege application user. Reliable local attribution requires Okta Access Gateway-specific product, version, Protected Rule, application-user, request, authorization, protected-resource, downstream-access, and incident-response context beyond the current generic remote-access detections. Existing S25 behavior can represent consequential identity misuse or abnormal downstream access but does not directly identify the Okta-specific initiating condition.

CVE-2025-53521 is Coverage With Adaptation because its defining F5 BIG-IP APM behavior is unauthenticated remote code execution against an affected virtual server with an APM access policy, while reliable local attribution requires F5-specific asset, version, APM-policy, TMM, web, process, runtime, memory, filesystem, service, and network context beyond the current RRAS, SonicWall, WatchGuard, OpenVPN, strongSwan, Cisco, or Check Point-focused S25 implementations. F5-confirmed exploitation and CISA KEV status increase remediation and compromise-assessment urgency but do not make the current S25 implementation CVE-specific.

The PoisonedRefresh / F5 c05d5254 procedure set is Coverage With Adaptation because the existing detection behavior can represent gateway compromise, unexpected process or shell execution, configuration modification, persistence, credential or session exposure, internal access, and downstream effects, but complete coverage of the documented implant requires BIG-IP APM-specific Apache and PHP runtime visibility, /usr/sbin/httpd integrity, upgrade-image inspection, SELinux-state review, memory inspection, libphp and APR-loading context, UNIX-domain-socket evidence, and forensic validation. Disk-only web-shell searches are insufficient because the malicious PHP content may exist only in the Apache/PHP process memory view.

CVE-2026-50751 is Coverage With Adaptation because its defining Check Point behavior is unauthenticated bypass of Remote Access VPN or Mobile Access user authentication through a logic-flow weakness in deprecated IKEv1 certificate validation, followed by establishment of a remote-access VPN session without the expected valid user credential. Reliable coverage requires Check Point Security Gateway, Remote Access VPN or Mobile Access, IKEv1, legacy-client, machine-certificate, VPN-session, source, identity, authentication, network, downstream-access, and forensic context that is not natively represented by the existing RRAS, SonicWall, WatchGuard, OpenVPN, strongSwan, or SmartConsole-focused S25 implementations.

Check Point states that active exploitation began as early as May 7, 2026 and increased in early June. CISA subsequently added CVE-2026-50751 to KEV. Check Point also reports confirmed post-compromise activity associated with a Qilin ransomware affiliate in one case and assesses with medium confidence that the actor behind the observed exploitation was financially motivated and associated with Qilin-related activity. This exploitation and ransomware context increases remediation, compromise-assessment, and retrospective-hunting urgency but does not change the Coverage With Adaptation classification or independently prove Qilin involvement in a local event.

CVE-2026-20349 remains Coverage With Adaptation because its defining Cisco Remote Access SSL VPN behavior is crafted HTTP activity followed by appliance reload and denial of service rather than Windows RemoteAccess service-host execution. Cisco states that PSIRT became aware of active exploitation in August 2026, and CISA added CVE-2026-20349 to KEV on August 11, 2026. The authoritative exploitation-state and KEV evidence increase remediation and investigation urgency but do not alter the Coverage With Adaptation classification or independently prove successful exploitation of a particular local device.

CVE-2026-19318, CVE-2026-19315, and CVE-2026-19313 are Coverage With Adaptation because their defining behavior involves pre-authentication memory-safety flaws in the WatchGuard Fireware OS iked process rather than Windows RemoteAccess service-host execution or an existing SonicWall proxy-to-local-service path. The three vulnerabilities can be reached through attacker-controlled IKE traffic and may cause iked termination, respawn, denial of service, memory corruption, and potential remote code execution. Reliable CVE-specific detection and assessment require WatchGuard Fireware asset and version context, IKE protocol evidence, iked daemon-health and crash/respawn visibility, appliance telemetry, and incident-response evidence beyond the existing S25 implementation. CVE-2026-19318 additionally requires IKE payload diagnostic logging to be enabled for exploitation. WatchGuard states that it is not aware of exploitation in the wild for these vulnerabilities.

CVE-2025-14733 is Coverage With Adaptation because its defining behavior involves a critical out-of-bounds write in the WatchGuard Fireware OS iked process rather than Windows RemoteAccess service-host execution or an existing SonicWall proxy-to-local-service path. The vulnerability is remotely reachable without authentication under affected IKEv2 configurations and may permit arbitrary code execution. Reliable CVE-specific detection and assessment require WatchGuard Fireware asset and version context, applicable current or historical IKEv2 configuration, IKE protocol evidence, iked daemon-health and crash/respawn visibility, appliance telemetry, memory-corruption or execution evidence where available, network activity, downstream evidence, and incident-response findings beyond the existing S25 implementation. CISA identifies CVE-2025-14733 as used in known ransomware campaigns. That exploitation state increases remediation, compromise-assessment, and retrospective-hunting urgency but does not establish successful local exploitation or identify a specific ransomware family.

CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, and CVE-2026-102258 are Coverage With Adaptation under the existing SonicWall remote-access-gateway behavior model. CVE-2026-102255 involves pre-authentication SSRF through an unintended alternate access path in the SMA1000 Work Place interface. CVE-2026-102256 involves post-authentication OS command injection with remote-code-execution potential. CVE-2026-102257 involves Appliance Management Console Zip Slip path traversal with remote-code-execution consequences. CVE-2026-102258 involves stored cross-site scripting in the Appliance Management Console. Existing S25 behavior can represent consequential appliance-local access, command execution, administrative abuse, identity use, internal expansion, or downstream activity once observable, but reliable attribution to these four initiating conditions requires SonicWall-specific product, exact-version, Work Place or Appliance Management Console, request, authentication, archive or file, process or command-execution, application, appliance, network, and incident-response context. Current authoritative evidence does not establish confirmed in-the-wild exploitation or CISA KEV status for the four vulnerabilities.

CVE-2026-83548 and CVE-2026-83549 are Direct Coverage under the existing SonicWall behavior model. CVE-2026-83548 is a pre-authentication SSRF condition through unintended forward-proxy behavior in SMA1000 and maps directly to the existing proxy-to-appliance-local-service detection path. CVE-2026-83549 is a post-authentication remote-code-execution condition requiring administrative privileges and maps directly to the existing appliance-administration and command-execution detection path. SonicWall reports both vulnerabilities as actively exploited in the wild. CISA added CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities Catalog on September 2, 2026. The vendor-confirmed active-exploitation state and CISA KEV status increase remediation and compromise-assessment urgency but do not independently prove local compromise or alter the existing Direct Coverage classifications.

CVE-2026-15409 and CVE-2026-15410 remain Direct Coverage under the existing SonicWall proxy-to-local-service and appliance-administration detection paths.

CVE-2026-16232 remains Coverage With Adaptation because its defining behavior depends on Check Point SmartConsole application-token acquisition and unauthorized administrative authentication.

CVE-2026-84732, CVE-2026-84256, CVE-2026-84226, CVE-2026-82312, CVE-2026-78221, CVE-2026-78043, and CVE-2026-81738 are Coverage With Adaptation because their defining behavior depends on OpenVPN-specific platform, service-mode, certificate, validation-script, binary-search-path, IPC, NRPT, DHCP, configuration-path, process, and network-configuration conditions that are not natively represented by the current S25 implementation. The affected scope reaches OpenVPN 2.6 releases through 2.6.22 and the 2.7 development line through 2.7.6, subject to CVE-specific lower-version boundaries and configuration qualifications.

CVE-2026-84732 involves an OpenVPN reliability-layer condition involving unbounded TLS timeout and invalid ACK handling that can result in service disruption.

CVE-2026-84256 involves Windows CreateProcess() quoting and argument parsing in a validation-script plus rogue-CA scenario and can allow an authenticated remote user to execute commands through crafted certificate-subject data.

CVE-2026-84226 involves an unqualified netsh.exe invocation by tapctl that creates a local binary-planting path during network configuration.

CVE-2026-82312 involves insecure permissions on Windows OpenVPN system objects and can allow local denial of service under affected service configurations.

CVE-2026-78221 involves OpenVPN Windows service NRPT domain-size handling with UTF-8 internationalized domain names and can produce a buffer overread.

CVE-2026-78043 involves Windows Interactive Service configuration-path validation using / and can allow an authenticated local user to cause execution with an unauthorized configuration.

CVE-2026-81738 involves DHCP DOMAIN-SEARCH handling and can produce a one-byte buffer overwrite from crafted option data.

Reliable assessment of these seven CVEs requires OpenVPN platform, package, version, service mode, configuration, validation-script, CA and certificate, file and path, process and command-line, service-control, IPC, tapctl, netsh.exe, NRPT, DHCP, tunnel, authentication, session, fault, network, and downstream evidence as applicable. Remediation is OpenVPN 2.7.7 or the applicable maintained vendor or distribution security build. Current authoritative evidence does not establish confirmed in-the-wild exploitation or CISA KEV status for these seven CVEs.

The strongSwan 6.1.0 vulnerability set is Coverage With Adaptation because its defining behaviors depend on strongSwan-specific IKE, plugin, certificate, EAP, X.509, IKE SA, Child SA, rekey, authentication-state, and daemon-health conditions that are not natively represented by the current S25 implementation. strongSwan 6.1.0 fixes eleven vulnerabilities.

CVE-2026-78123 affects the strongSwan OpenSSL plugin's handling of PKCS#7 signerInfo and recipientInfo structures. Improper initialization can cause undefined memory access and a crash. Affected versions begin with 5.0.2.

CVE-2026-78124 affects enumeration of certificates in PKCS#7 containers by the strongSwan OpenSSL plugin and can produce repeated memory leakage. Affected versions begin with 5.0.2. The documented principal remote path involves IKEv1 PKCS#7 certificate payload processing. The vendor does not identify this issue as a remote-code-execution pathway.

CVE-2026-78126 affects the eap-aka plugin's handling of an unexpected AKA-Synchronization-Failure message and can produce a null-pointer crash. Affected versions begin with 4.1.10.

CVE-2026-78127 affects libcharon IKE-message stringification and can leak memory repeatedly until service availability is affected through memory exhaustion. Affected versions begin with 4.1.2.

CVE-2026-78129 affects encrypted PKCS#7 processing in libstrongswan. Attacker-controlled cryptographic parameters can cause unbounded processing or a crash and produce denial of service. Affected versions begin with 4.6.2.

CVE-2026-78130 affects verification of X.509 attribute certificates in the x509 plugin and can trigger a null-pointer dereference when required issuer information is absent. Affected versions begin with 4.2.0. The vendor identifies the documented consequence as denial of service rather than remote code execution.

CVE-2026-78131 affects parsing of identities in X.509 attribute certificates and can cause memory leakage and eventual memory exhaustion. Affected versions begin with 4.2.0.

CVE-2026-78132 affects parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute certificates and can cause an infinite loop and denial of service. Affected versions begin with 5.1.3.

CVE-2026-78133 affects libcharon handling of IKEv2 rekey collisions involving multiple key exchanges. A use-after-free may occur and could potentially be exploited for remote code execution by an authenticated peer. Affected versions begin with 6.0.0.

CVE-2026-78134 affects propagation of authentication details from inner EAP methods when EAP-PEAP or EAP-TTLS is used. The condition can produce incorrect identity binding and potential authorization bypass. The attacker must successfully authenticate with valid credentials. Affected versions begin with 4.5.0.

CVE-2026-78135 affects libcharon handling of CREATE_CHILD_SA requests on unestablished IKE SAs. An unauthenticated peer may potentially establish a usable Child SA before authentication completes. Affected versions begin with 5.9.7.

Reliable assessment of the eleven strongSwan vulnerabilities requires product, package, version, IKEv1/IKEv2, plugin, PKCS#7, certificate, X.509, EAP method, outer and inner identity, authenticated-peer, IKE SA, Child SA, CREATE_CHILD_SA, rekey, Multi-KE, service-health, memory-pressure, crash, process, network, authentication, tunnel, downstream-access, and incident-response evidence as applicable. Remediation is strongSwan 6.1.0 or the applicable maintained vendor or distribution security build. Current authoritative evidence does not establish confirmed in-the-wild exploitation or CISA KEV status for these eleven CVEs.

CVE-2025-40595, CVE-2025-2170, CVE-2023-44221, and CVE-2021-20035 retain their existing Direct Coverage classifications.

CVE-2025-23006, CVE-2025-32819, CVE-2025-32820, CVE-2025-32821, CVE-2024-38475, CVE-2024-40766, and CVE-2021-20016 retain their existing Coverage With Adaptation classifications.

Known exploitation, KEV inclusion, public exploit availability, vulnerable-version state, vendor priority, and static indicators are urgency and remediation inputs. They are not proof that compromise occurred in a specific environment. Local compromise assessment must remain grounded in RRAS network and service-process activity, Okta Access Gateway authorization and protected-resource activity where applicable, Check Point IKEv1 and VPN-session activity where applicable, Cisco SSL VPN requests and device-health activity where applicable, OpenVPN service and configuration activity where applicable, strongSwan IKE, plugin, EAP, IKE SA, Child SA, rekey, service-health, authentication, and network evidence where applicable, gateway requests, IKE activity where applicable, connection results, daemon-health and appliance evidence, management-server access, SmartConsole and administrator sessions, application-token activity, Trusted Client configuration, security-policy and configuration changes, policy publication and installation, administrative events, session context, identity activity, endpoint behavior, internal-network activity, cloud evidence, and incident-response findings.

Detection Engineering Coverage Interpretation

The S25 detection content provides direct behavioral coverage when activity produces one or more of these implemented outcomes:

·        External network activity against a confirmed Windows RRAS server followed by suspicious child-process execution from a process positively attributed to the RemoteAccess service

·        External proxy, relay, or WebSocket requests to loopback, localhost, link-local, appliance-local, or prohibited gateway services with evidence of successful connection establishment

·        Unauthorized hotfix removal, configuration change, route modification, service change, script execution, traversal-path activity, temporary-file activity, or prohibited gateway-object modification

·        Successful gateway-originated authentication to internal identity services without a matching authorized VPN session or approved service context and with a meaningful baseline deviation

·        Suspicious shell, script, administrative-tool, credential-access, discovery, remote-management, or persistence execution on a protected endpoint following a gateway-originated connection

·        New, rare, unapproved, or role-inconsistent internal communication from the gateway or RRAS host after suspicious gateway or RRAS activity

·        Provider-specific cloud activity involving gateway-associated accounts or addresses when joined to suspicious gateway, RRAS, identity, session, or network evidence

Detection coverage is behavior-led rather than vulnerability-led. The Windows RRAS rules do not identify an RRAS CVE by name. They identify the common observable exploit-to-execution outcome represented by the network-reachable RRAS RCE family. CVE fingerprinting, vulnerable-version status, exploit strings, service faults, generic svchost.exe activity, and static indicators are not required for Direct Coverage.

CVE-2026-104935 remains Coverage With Adaptation because reliable identification of the initiating Ivanti Connect Secure authentication-bypass and unauthenticated command-execution condition depends on affected product and exact-version validation, applicable authentication and request context, appliance execution and configuration telemetry, session evidence, network activity, downstream identity or infrastructure access, and incident-response findings beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential appliance compromise, unexpected command or process execution, unauthorized authentication, internal expansion, cloud access, persistence, or other downstream effects when observable but does not directly identify the CVE-2026-104935 initiating condition. Ivanti-confirmed exploitation and CISA KEV status increase remediation and retrospective-hunting urgency but do not change the adapted classification or independently prove local compromise.

CVE-2026-107406 remains Coverage With Adaptation because reliable identification of the initiating Citrix NetScaler memory-overflow condition depends on affected product and exact-version validation, release-dependent SAML SP or SAML IdP configuration, inbound SAML and authentication evidence, gateway process, memory, service-health, crash or restart, execution, appliance, network, and incident-response context beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential remote code execution, gateway compromise, unauthorized authentication, internal expansion, cloud access, or other downstream behavior when observable but does not directly identify the CVE-2026-107406 initiating condition. Neither vulnerable-version state nor SAML configuration alone establishes exploitation.

CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, and CVE-2026-102258 remain Coverage With Adaptation because reliable identification depends on SonicWall SMA1000-specific version, Work Place or Appliance Management Console context, authentication state, request and destination evidence, administrative activity, archive and filesystem evidence where applicable, application and browser evidence where applicable, command and process execution, appliance, network, and incident-response context beyond the currently implemented generic remote-access detections. Existing S25 behavior may identify consequential SSRF-mediated appliance-local access, unauthorized command execution, administrative misuse, internal expansion, identity use, persistence, or other downstream activity once observable, but it does not directly identify the four October 2026 initiating vulnerabilities. Current authoritative evidence does not establish confirmed in-the-wild exploitation or CISA KEV status for the four CVEs.

CVE-2026-94127 remains Coverage With Adaptation because reliable identification of the initiating heap-based buffer overflow and resulting unauthenticated remote code execution depends on F5 BIG-IP APM-specific version, virtual-server, APM access-policy, OAuth-profile, request, TMM, process, memory, service, network, appliance, and incident-response context beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential gateway compromise, shell or process execution, identity use, internal expansion, cloud access, persistence, or downstream effects once they become observable, but it does not directly identify the CVE-2026-94127 initiating condition. F5-confirmed exploitation and CISA KEV status increase remediation and compromise-assessment urgency but do not change that adapted classification or independently prove local compromise.

CVE-2026-78626 remains Coverage With Adaptation because reliable identification depends on Okta Access Gateway-specific version, Protected Rule configuration, authenticated application-user and privilege context, request and authorization evidence, protected-resource mapping, downstream application access, and incident-response context beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential identity or downstream-access anomalies once observable, but it does not directly identify the Okta-specific authorization-bypass condition.

CVE-2025-53521 remains Coverage With Adaptation because reliable identification of the initiating exploit and PoisonedRefresh follow-on activity depends on F5 BIG-IP APM-specific version, APM access-policy, TMM, Apache, PHP, runtime-memory, process, filesystem, upgrade-image, service, network, and incident-response context beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential gateway compromise, shell execution, configuration change, persistence, identity use, internal expansion, cloud access, or downstream effects once they become observable, but it does not directly identify the F5-specific RCE or memory-only PHP web-shell mechanism.

CVE-2026-50751 remains Coverage With Adaptation because reliable identification of an authentication-bypass-created VPN session depends on Check Point-specific Remote Access or Mobile Access, IKEv1, legacy-client, machine-certificate, session, identity, source, and downstream-access context beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential gateway-originated authentication, endpoint execution, internal expansion, cloud access, persistence, or ransomware-related behavior once those outcomes become observable.

CVE-2026-20349 remains Coverage With Adaptation because reliable identification depends on Cisco-specific Remote Access SSL VPN configuration, HTTP-request, appliance-health, reload, availability, network, and incident-response context. Cisco-confirmed exploitation and CISA KEV status do not make the existing S25 implementation CVE-specific and do not change the adapted classification.

The seven OpenVPN 2.7.7 CVEs remain Coverage With Adaptation because reliable identification depends on OpenVPN-specific product, platform, service-mode, certificate, validation-script, path, service-control, IPC, NRPT, DHCP, and network-configuration context beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential command execution, service or process anomalies, configuration change, authentication and session deviations, tunnel behavior, fault or restart activity, identity pivoting, or downstream access when those outcomes become observable.

The eleven strongSwan 6.1.0 CVEs remain Coverage With Adaptation because reliable identification depends on strongSwan-specific version, plugin, IKEv1/IKEv2, PKCS#7, X.509, EAP, authenticated-peer, IKE SA, Child SA, CREATE_CHILD_SA, rekey, Multi-KE, service-health, process, authentication, and tunnel context beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential unauthorized VPN access, gateway or daemon instability, identity deviations, gateway-originated authentication, endpoint execution, internal expansion, cloud access, persistence, or downstream effects after they become observable, but it does not directly identify the strongSwan-specific initiating condition.

CVE-2025-14733 remains Coverage With Adaptation because reliable identification of the initiating WatchGuard Fireware OS iked out-of-bounds-write condition depends on affected product and version context, applicable IKEv2 configuration, historical configuration state where relevant, inbound IKE evidence, iked daemon-health or crash/respawn evidence, appliance telemetry, memory-corruption or execution evidence where available, network evidence, downstream activity, and incident-response findings beyond the currently implemented generic remote-access detections. Existing S25 logic may identify consequential gateway compromise, unexpected execution, gateway-originated authentication, endpoint execution, internal expansion, cloud access, persistence, or ransomware-related behavior once those outcomes become observable. CISA's known-ransomware-campaign-use designation increases urgency but does not make the existing S25 implementation CVE-specific or establish a ransomware-family attribution.

Named malware, ransomware, and adversary coverage is procedure-led. S25 can detect individual documented procedures associated with OVERSTEP, UNC6148, Akira, INC ransomware, Qilin ransomware-affiliate activity, PoisonedRefresh / F5 c05d5254 activity, Fire Ant, or another activity set when those procedures produce observable gateway modification, unexplained authentication, unauthorized VPN access, endpoint execution, internal expansion, cloud activity, persistence, or security-control degradation. It cannot identify a malware family, ransomware family, campaign, affiliate, or threat actor from those behaviors alone.

Fire Ant remains Coverage With Adaptation because complete procedure-set coverage requires Cisco IOS XR or equivalent router telemetry, TACACS or equivalent authentication-server visibility, Linux management-host telemetry, and independent forensic validation beyond the currently implemented S25 searches.

Direct Coverage

Direct coverage applies where documented exploitation procedures produce observable behavior inside the implemented S25 model and the required telemetry is available.

Directly Covered CVEs

·        CVE-2026-83549

·        CVE-2026-83548

·        CVE-2026-26111

·        CVE-2026-25173

·        CVE-2026-25172

·        CVE-2026-20868

·        CVE-2026-15410

·        CVE-2026-15409

·        CVE-2025-64678

·        CVE-2025-62549

·        CVE-2025-62452

·        CVE-2025-54113

·        CVE-2025-50164

·        CVE-2025-50163

·        CVE-2025-49670

·        CVE-2025-49669

·        CVE-2025-48824

·        CVE-2025-40595

·        CVE-2025-33066

·        CVE-2025-33064

·        CVE-2025-24051

·        CVE-2025-2170

·        CVE-2025-21410

·        CVE-2025-21208

·        CVE-2024-49125

·        CVE-2024-49102

·        CVE-2024-49089

·        CVE-2024-49086

·        CVE-2024-49085

·        CVE-2024-43611

·        CVE-2024-43607

·        CVE-2024-43593

·        CVE-2024-43564

·        CVE-2024-43549

·        CVE-2024-43453

·        CVE-2024-38265

·        CVE-2024-38212

·        CVE-2024-38154

·        CVE-2024-38130

·        CVE-2024-38121

·        CVE-2024-30029

·        CVE-2024-30024

·        CVE-2024-30022

·        CVE-2024-30015

·        CVE-2024-30014

·        CVE-2024-30009

·        CVE-2024-26205

·        CVE-2024-26200

·        CVE-2024-26179

·        CVE-2023-44221

·        CVE-2023-35367

·        CVE-2023-35366

·        CVE-2023-35365

·        CVE-2021-20035

The Windows RRAS CVEs are directly covered at the behavioral level only when exploitation produces the S25-visible externally sourced network activity followed by suspicious execution from a process positively attributed to the RemoteAccess service and the necessary telemetry is preserved. Direct coverage does not mean every exploitation attempt will be detected or that an alert identifies the specific CVE.

The SonicWall SMA1000 CVE-2026-83548 and CVE-2026-83549 pair is directly covered at the behavioral level through the existing proxy-to-appliance-local-service and authenticated appliance-administration/command-execution paths. Direct coverage does not mean the implemented detections identify either CVE by name or that vulnerable-version state, public reporting, vendor-confirmed active exploitation, or CISA KEV status proves local compromise.

Directly Covered Malware Procedure Sets

·        None

Directly Covered APT or Activity-Group Procedure Sets

·        None

Coverage With Adaptation

Coverage with adaptation applies where related activity falls inside the report's behavior model but requires additional local telemetry, mappings, query expansion, or correlation.

·        CVE-2026-102764 — BeyondTrust Remote Support improper origin validation in an internal messaging component permitting unauthorized appliance file operations by an unauthenticated remote attacker. Coverage requires affected BeyondTrust Remote Support product and exact-version validation; confirmation of the applicable self-hosted or SaaS deployment and historical exposure window; internal messaging and unauthorized file-operation evidence where available; appliance web and reverse-proxy activity; process, filesystem, privileged-execution, configuration, persistence, administrative, credential-vault, and support-session telemetry; outbound and internal network evidence; downstream identity or infrastructure activity; and incident-response findings sufficient to distinguish vulnerable-state, scanning, unsuccessful exploitation attempts, legitimate administration, and successful appliance compromise. Affected Remote Support versions include releases through 26.2.3. BeyondTrust reports Remote Support SaaS patch deployment on October 9, 2026, and provides BT26-05-RS remediation for supported self-hosted releases, with an upgrade prerequisite for earlier versions. Mandiant documents confirmed zero-day exploitation beginning in late August 2026 by ARMORY CASTLE, formerly UNC5221, including SAWFLY PHP webshell deployment, BARECLAW SOCKS5-over-WebSocket tunneling, SUID-based privilege escalation, credential-vault access attempts, persistence, HAProxy manipulation, administrative abuse, remote-support session abuse, internal reconnaissance, lateral movement, and log deletion. Existing S25 behavioral detections provide relevant downstream coverage when required telemetry is available but do not independently identify CVE-2026-102764 or attribute activity to ARMORY CASTLE. Published SAWFLY and BARECLAW YARA signatures are artifact-based detection opportunities requiring accessible forensic material and do not establish behavioral execution or successful compromise. Confirmed campaign exploitation and CISA's October 16, 2026 addition of CVE-2026-102764 to the Known Exploited Vulnerabilities Catalog increase remediation, compromise-assessment, and retrospective-hunting urgency but do not independently prove compromise of a particular deployment. The vulnerability remains Coverage With Adaptation, and the KEV designation does not require additional generic S25 behavioral detection rules.

·        CVE-2026-104935 — Ivanti Connect Secure authentication bypass by spoofing permitting unauthenticated remote command execution. Coverage requires affected Ivanti Connect Secure product and exact-version validation; confirmation of the applicable vulnerable authentication boundary; relevant inbound request, authentication, and VPN-session evidence; appliance process and command-execution telemetry; configuration and filesystem activity; outbound network behavior; downstream identity or infrastructure access; and incident-response findings sufficient to distinguish vulnerable-state, scanning, unsuccessful exploitation attempts, authorized administrative activity, and successful unauthorized execution. Affected releases include applicable versions through 22.8R2.4 within the 22.8 branch, 25.1.2.2 within the 25.1.2 branch, and 25.1.1.1 within the 25.1.1 branch, subject to release-specific prerequisites. The 22.7 branch is identified as unaffected. Unaffected releases identified by the CNA include 22.7R2.14, 22.8R2.5, 25.1.3.0, and 25.1.3.1. Ivanti confirms limited exploitation in the wild, and CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities Catalog on October 13, 2026, with an October 16, 2026 remediation deadline. KEV designation increases remediation and compromise-assessment urgency but does not independently establish successful exploitation of a specific deployment.

·        CVE-2026-107406 — Citrix NetScaler ADC and NetScaler Gateway memory-overflow vulnerability capable of remote code execution or denial of service under affected SAML SP or SAML IdP configurations. Coverage requires affected NetScaler product and exact-version context; confirmation of the applicable SAML SP or SAML IdP prerequisite; relevant inbound SAML, authentication, gateway-request, service-health, crash or restart, memory, process, execution, appliance, network, downstream-access, and incident-response evidence; and sufficient correlation to distinguish ordinary SAML processing or service instability from exploitation. Affected version and configuration boundaries vary by release. Corrected releases include NetScaler ADC and Gateway 14.1-73.46 and 13.1-64.29, NetScaler ADC FIPS 14.1-73.46, and NetScaler ADC FIPS / NDcPP 13.1-37.283 or later. Current authoritative evidence does not establish confirmed exploitation in the wild or CISA KEV status.

·        CVE-2026-102258 — SonicWall SMA1000 Appliance Management Console post-authentication stored cross-site scripting. Coverage requires affected SMA1000 product and exact-version context, authenticated administrator identity and session context, AMC input and page-generation evidence where available, stored-content provenance, browser and administrative activity, application and appliance telemetry, network evidence, and incident-response findings sufficient to distinguish authorized administrative content from exploitation. Affected releases include 12.4.3-03526 and earlier and 12.5.0-02952 and earlier. Corrected releases are 12.4.3-03670 and 12.5.0-03082 or later. Current authoritative evidence does not establish active exploitation or CISA KEV status

·        CVE-2026-102257 — SonicWall SMA1000 Appliance Management Console Zip Slip vulnerability allowing specially crafted archive content to be extracted outside the intended destination directory and resulting in remote-code-execution potential. Coverage requires affected SMA1000 product and exact-version context, authenticated administrative access where applicable, archive-upload and extraction evidence, file and path provenance, filesystem modification, process or execution telemetry, appliance and network evidence, and incident-response findings sufficient to distinguish authorized archive processing from exploitation. Affected releases include 12.4.3-03526 and earlier and 12.5.0-02952 and earlier. Corrected releases are 12.4.3-03670 and 12.5.0-03082 or later. Current authoritative evidence does not establish active exploitation or CISA KEV status

·        CVE-2026-102256 — SonicWall SMA1000 post-authentication OS command injection that can permit a remote authenticated administrator under affected conditions to execute arbitrary OS commands and achieve remote code execution. Coverage requires affected SMA1000 product and exact-version context, administrator identity and authentication state, management request and parameter evidence where available, command-line and process telemetry, appliance administration and configuration activity, filesystem and network evidence, and incident-response findings sufficient to distinguish authorized administration from exploitation. Affected releases include 12.4.3-03526 and earlier and 12.5.0-02952 and earlier. Corrected releases are 12.4.3-03670 and 12.5.0-03082 or later. Current authoritative evidence does not establish active exploitation or CISA KEV status

·        CVE-2026-102255 — SonicWall SMA1000 Work Place pre-authentication server-side request forgery caused by an unintended alternate access path. An unauthenticated remote attacker can potentially cause the appliance to issue requests on the attacker's behalf, reach internal functionality, and perform unauthorized operations. Coverage requires affected SMA1000 product and exact-version context, Work Place exposure, inbound request and requested-destination evidence where available, appliance-originated request and connection-result telemetry, internal-function or appliance-local access evidence, authentication state, appliance and network telemetry, and incident-response findings sufficient to distinguish scanning or failed requests from successful SSRF-mediated access. Affected releases include 12.4.3-03526 and earlier and 12.5.0-02952 and earlier. Corrected releases are 12.4.3-03670 and 12.5.0-03082 or later. Current authoritative evidence does not establish active exploitation or CISA KEV status

·        CVE-2026-88779 — Citrix NetScaler ADC and NetScaler Gateway memory overflow leading to denial of service. Exploitation requires the appliance to be configured as a SAML SP or SAML IdP. Coverage requires affected NetScaler product and exact-version context; SAML SP or SAML IdP configuration state; relevant inbound SAML, authentication, gateway, service-health, crash or restart, memory, appliance, network, and incident-response evidence; and sufficient correlation to distinguish exploitation from ordinary SAML processing or service instability. Affected releases are NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, NetScaler ADC FIPS 14.1 before 14.1-73.41 FIPS, and NetScaler ADC FIPS / NDcPP 13.1 before 13.1-37.282. CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities Catalog on October 4, 2026, based on evidence of active exploitation. The KEV designation increases remediation and investigation urgency but does not independently prove local compromise.

·        CVE-2026-86134 — WatchGuard Fireware OS pre-authentication NULL pointer dereference in the authentication process. A remote unauthenticated attacker can send a specially crafted request to the login interface and crash the management daemon, resulting in denial of service. Coverage requires affected Fireware OS product and version context, login-interface request evidence where available, management-daemon health and restart evidence, appliance system telemetry, network context, and incident-response findings sufficient to distinguish exploitation from ordinary management-service failure. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-86104 — WatchGuard Fireware OS uncontrolled resource consumption in the wgagent login process. A remote unauthenticated attacker can send a specially crafted request and cause denial of service. Coverage requires affected Fireware OS product and version context, login-request evidence where available, wgagent process and resource-health telemetry, appliance system evidence, network context, and incident-response findings sufficient to distinguish exploitation from legitimate load or operational instability. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-18145 — WatchGuard Fireware OS stack-based buffer overflow in spamd. Exploitation requires authenticated privileged access and can result in spamd process impact or arbitrary-code execution. Coverage requires affected Fireware OS product and version context, authenticated administrator identity and session context, spamd or spamBlocker service state, management-request evidence where available, process-health, crash, memory-corruption or execution telemetry, appliance evidence, and incident-response findings sufficient to distinguish approved administration from exploitation. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-13046 — WatchGuard Fireware OS deserialization of untrusted data in samld. Exploitation requires an attacker to have already obtained the ability to write files on the appliance; a maliciously crafted session file can then be loaded by samld and execute arbitrary code in the samld service context. Coverage requires affected Fireware OS product and version context, evidence of the prerequisite file-write capability, samld session-file provenance, SAML service and process telemetry, execution evidence where available, appliance, identity, network, and incident-response context. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; EUCC releases are >=12.11 and <12.11.10. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and EUCC 12.11.10 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-86101 — WatchGuard Fireware OS SAML-login authorization bypass. A remote authenticated SAML user with access only to the Access Portal can send a specially crafted request and obtain unauthorized Mobile VPN with SSL access. Coverage requires affected Fireware OS product and version context, SAML and Access Portal configuration, authenticated user and entitlement context, request and authorization evidence, SSLVPN session creation, VPN-session attribution, downstream activity, and incident-response findings sufficient to distinguish approved access from authorization-bypass-created VPN access. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-86133 — WatchGuard Fireware OS integer underflow in iked. A remote attacker who has completed the initial IKEv2 handshake can send a specially crafted encrypted IKEv2 message that crashes iked and causes denial of service. Coverage requires affected Fireware OS product and version context, IKEv2 handshake and encrypted-message evidence where available, peer and session context, iked daemon-health and crash/respawn evidence, appliance and network telemetry, and incident-response findings. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-13224 — WatchGuard Fireware OS path traversal in the WebUI management agent. An authenticated administrator can send specially crafted management requests to read or list arbitrary files on the local filesystem. Coverage requires affected Fireware OS product and version context, administrator identity and session context, Management Web UI request evidence, path and file-access telemetry where available, management-agent activity, appliance evidence, and incident-response findings sufficient to distinguish authorized administration from unauthorized file access. Affected releases are >=12.0 and <12.5.21 and, for Default releases, >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3. Corrected releases are 12.5.21, 2026.3.2, 2026.2.3, and 12.12.3 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-86132 — WatchGuard Fireware OS pre-authentication integer underflow in the IKEv2 daemon. A remote unauthenticated attacker can crash iked by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite. WatchGuard identifies affected Firebox systems configured with a branch-office VPN using IKEv2 to a dynamic peer or a mobile VPN using IKEv2. Coverage requires affected Fireware OS product and version context, applicable IKEv2 configuration, AES-GCM negotiation and encrypted-message evidence where available, iked daemon-health and crash/respawn evidence, VPN and network context, appliance evidence, and incident-response findings. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-86105 — WatchGuard Fireware OS improper authorization in the Access Portal reverse proxy. An authenticated low-privileged Access Portal user can send a specially crafted request for a resource the user is authorized to access and reach other web applications the user is not authorized to access. Coverage requires affected Fireware OS product and version context, Access Portal and reverse-proxy configuration, authenticated user and entitlement context, request, resource, authorization, proxy, downstream application, network, and incident-response evidence. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-90441 — WatchGuard Fireware OS missing authorization in the wgagent management API, Variant B. An authenticated low-privileged user, including a read-only or guest administrator account, can submit a specially crafted management API request that crashes wgagent and reads arbitrary files accessible to the daemon. Coverage requires affected Fireware OS product and version context, administrator identity and privilege context, management-API request evidence, wgagent process and session-initialization telemetry, file-access evidence where available, appliance and service-health evidence, and incident-response findings. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-86131 — WatchGuard Fireware OS code injection in BOVPN Over TLS client configuration handling. An attacker who controls the remote VPN server can execute arbitrary commands as root on a connecting Firebox. Coverage requires affected Fireware OS product and version context, BOVPN Over TLS configuration, remote VPN destination and server-control context, connection and configuration evidence, root-level process or command execution, appliance and network telemetry, and incident-response findings sufficient to distinguish approved VPN operation from malicious server-driven execution. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-86136 — WatchGuard Fireware OS missing authorization in the wgagent management API, Variant A. An authenticated low-privileged user, including a read-only or guest administrator account, can submit a specially crafted management API request that crashes wgagent and reads arbitrary files accessible to the daemon. Coverage requires affected Fireware OS product and version context, administrator identity and privilege context, management-interface and API request evidence, wgagent session-initialization and process telemetry, file-access evidence, service-health, appliance, network, and incident-response findings. Affected Default releases are >=2026.0 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-81433 — WatchGuard Fireware OS pre-authentication stack-based buffer overflow in the DHCP fingerprinting daemon, fingerd. An unauthenticated attacker with adjacent network access can send a specially crafted DHCP packet to execute arbitrary code or crash the process. Coverage requires affected Fireware OS product and version context, adjacent-network and DHCP exposure, DHCP packet evidence where retained, fingerd process, crash, memory-corruption or execution telemetry, appliance and network evidence, and incident-response findings. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3. Corrected releases are 2026.3.2, 2026.2.3, and 12.12.3. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-86128 — WatchGuard Fireware OS NULL pointer dereference in NetFlow IPv6 packet processing. A remote unauthenticated attacker can send a specially crafted IPv6 packet and crash the NetFlow packet-processing service, resulting in denial of service. Coverage requires affected Fireware OS product and version context, NetFlow and IPv6 processing state, inbound packet and network evidence where available, service-health and crash telemetry, appliance evidence, and incident-response findings. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-18105 — WatchGuard Fireware OS uncontrolled resource consumption in diagnostic tasks. A low-privileged authenticated user can repeatedly start and abort a specially crafted diagnostic task through the Web UI and cause denial of service of the system's diagnostic tools. Coverage requires affected Fireware OS product and version context, authenticated user and privilege context, Web UI diagnostic-task creation and abort activity, resource-utilization and service-health telemetry, management and appliance evidence, and incident-response findings sufficient to distinguish abuse from legitimate diagnostic activity. Affected Default releases are >=2026.3 and <2026.3.2, >=2025.0 and <2026.2.3, and >=12.0 and <12.12.3; T15/T35 releases are >=12.0 and <12.5.21. Corrected releases are 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 as applicable. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-88771 — Citrix NetScaler ADC and NetScaler Gateway unauthenticated arbitrary command execution caused by improper input validation. Coverage requires affected NetScaler product and exact-version context; validation of internet-facing exposure; relevant gateway request, command-execution, process, service, configuration, network, appliance, and incident-response evidence where available; and sufficient correlation to distinguish vulnerable-state or scanning from successful command execution. Citrix confirms observed exploitation against unmitigated deployments. Fixed releases are NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later, NetScaler ADC FIPS 14.1-73.37 FIPS or later, and NetScaler ADC FIPS / NDcPP 13.1-37.279 or later. Citrix-confirmed exploitation and CISA KEV status increase remediation, retrospective-hunting, and compromise-assessment urgency but do not independently prove local compromise. CISA added CVE-2026-88771 to the Known Exploited Vulnerabilities Catalog on September 27, 2026, based on evidence of active exploitation.

·        CVE-2026-88772 — Citrix NetScaler ADC and NetScaler Gateway memory overflow leading to remote code execution or denial of service when DTLS is enabled. Coverage requires affected product and exact-version context; VPN virtual-server and DTLS configuration state; relevant inbound network, gateway service-health, crash, memory-corruption, process, execution, network, appliance, and incident-response evidence; and sufficient correlation to distinguish ordinary service instability from exploitation. Citrix states that DTLS is enabled by default on VPN virtual servers unless explicitly disabled and confirms observed exploitation against unmitigated deployments. Fixed releases are NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later, NetScaler ADC FIPS 14.1-73.37 FIPS or later, and NetScaler ADC FIPS / NDcPP 13.1-37.279 or later. Citrix-confirmed exploitation and CISA KEV status increase remediation, retrospective-hunting, and compromise-assessment urgency but do not independently prove local compromise. CISA added CVE-2026-88772 to the Known Exploited Vulnerabilities Catalog on September 27, 2026, based on evidence of active exploitation.

·        CVE-2026-88773 — Citrix NetScaler ADC and NetScaler Gateway HTTP request smuggling under affected HTTP configurations. Coverage requires affected product and exact-version context; confirmation that HTTP processing is enabled; front-end and back-end request parsing, request-boundary, connection, proxy, application, network, and incident-response evidence where available; and sufficient correlation to distinguish ordinary malformed traffic from consequential request smuggling. Fixed releases are NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later, NetScaler ADC FIPS 14.1-73.37 FIPS or later, and NetScaler ADC FIPS / NDcPP 13.1-37.279 or later.

·        CVE-2026-88774 — Citrix NetScaler ADC and NetScaler Gateway feature-policy bypass associated with HTTP URL-based policy expressions. Coverage requires affected product and exact-version context; relevant HTTP policy, URL-expression, configuration, request, enforcement-result, administrative, network, and incident-response evidence; and sufficient correlation to establish that policy evaluation was bypassed rather than merely misconfigured. Fixed releases are NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later, NetScaler ADC FIPS 14.1-73.37 FIPS or later, and NetScaler ADC FIPS / NDcPP 13.1-37.279 or later.

·        CVE-2026-88775 — Citrix NetScaler ADC and NetScaler Gateway memory overflow causing erroneous behavior or denial of service in Gateway or AAA virtual-server configurations. Coverage requires affected product and exact-version context; Gateway or AAA virtual-server configuration state; relevant inbound traffic, service-health, crash, restart, memory, network, appliance, and incident-response evidence; and sufficient correlation to distinguish exploitation from ordinary operational instability. Fixed releases are NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later, NetScaler ADC FIPS 14.1-73.37 FIPS or later, and NetScaler ADC FIPS / NDcPP 13.1-37.279 or later.

·        CVE-2026-88776 — Citrix NetScaler ADC memory overflow causing erroneous behavior or denial of service on Oracle-type load-balancing virtual servers. Coverage requires affected product and exact-version context; Oracle-type load-balancing virtual-server configuration; relevant inbound traffic, service-health, crash, restart, memory, network, appliance, and incident-response evidence; and sufficient correlation to distinguish malicious triggering from ordinary service instability. Fixed releases are NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later, NetScaler ADC FIPS 14.1-73.37 FIPS or later, and NetScaler ADC FIPS / NDcPP 13.1-37.279 or later.

·        CVE-2026-88777 — Citrix NetScaler ADC and NetScaler Gateway memory overflow causing erroneous behavior or denial of service under affected non-HTTP Layer-7 configurations. Coverage requires affected product and exact-version context; applicable Layer-7 protocol and virtual-server configuration; relevant inbound traffic, service-health, crash, restart, memory, network, appliance, and incident-response evidence; and sufficient correlation to distinguish exploitation from benign protocol or service failure. Fixed releases are NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later, NetScaler ADC FIPS 14.1-73.37 FIPS or later, and NetScaler ADC FIPS / NDcPP 13.1-37.279 or later.

·        CVE-2026-88778 — Citrix NetScaler ADC and NetScaler Gateway predictable TCP initial sequence numbers under affected TCP configuration. Coverage requires affected product and exact-version context; relevant TCP profile and Enhanced ISN Generation configuration state; network-flow and packet evidence where available; session, connection, and downstream activity; and incident-response findings sufficient to distinguish vulnerable configuration from consequential abuse. Citrix identifies Enhanced ISN Generation as an applicable mitigation. Fixed releases are NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later, NetScaler ADC FIPS 14.1-73.37 FIPS or later, and NetScaler ADC FIPS / NDcPP 13.1-37.279 or later.

·        CVE-2026-94127 — F5 BIG-IP APM heap-based buffer overflow leading to unauthenticated remote code execution when an APM access policy and an OAuth profile are configured on the same virtual server. Coverage requires affected F5 BIG-IP APM product and exact-version context; validation of the APM access-policy and OAuth-profile configuration; inbound request and OAuth-processing evidence where available; TMM, process, memory, service, network, appliance, and incident-response telemetry; and sufficient correlation to distinguish vulnerable-state or ordinary APM and OAuth traffic from successful remote code execution. F5 states that Appliance mode is also vulnerable and that this is a data-plane issue with no control-plane exposure. Affected supported branches are BIG-IP 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, 17.5.x before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and 17.1.x before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. F5 confirms exploitation in the wild, and CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities Catalog on September 22, 2026. The KEV designation increases remediation, retrospective-hunting, and compromise-assessment urgency but does not change the Coverage With Adaptation classification or independently prove local compromise.

·        CVE-2026-85102 — Check Point Quantum Security Gateway improper certificate validation during VPN negotiation. Coverage requires affected Check Point gateway and version context; Remote Access or Site-to-Site VPN exposure; certificate trust and validation evidence where available; inbound VPN negotiation, authentication, session, process, execution, network, configuration, and incident-response telemetry; and sufficient correlation to distinguish ordinary certificate-validation failures from successful exploitation. Check Point identifies R82.10 with Jumbo Hotfix Take 43 or below, R82 with Jumbo Hotfix Take 125 or below, and R81.20 with Jumbo Hotfix Take 165 or below as affected. The vulnerability is remotely reachable without authentication, is rated Critical with CVSS 9.8, and may permit arbitrary code execution on the Quantum Security Gateway. Check Point now confirms active exploitation attempts against Spark customers globally beginning September 12, 2026. The observed attempts originated from anonymization infrastructure, including VPN services and proxies. CISA added CVE-2026-85102 to the Known Exploited Vulnerabilities Catalog on September 22, 2026. The confirmed exploitation state and KEV designation increase remediation, compromise-assessment, and retrospective-hunting urgency but do not change the Coverage With Adaptation classification or independently prove successful exploitation of a specific local gateway.

·        CVE-2026-20329 — Cisco Secure Firewall ASA, Secure FTD, and Secure FMC improper handling of exceptional conditions, CWE-703. Coverage requires affected Cisco product and release validation plus product-specific exception, process, service-health, management, network, and incident-response evidence sufficient to distinguish vulnerable-state or ordinary operational failure from consequential abuse. Cisco identifies ASA, FTD, and FMC as affected regardless of device configuration. Applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. Applicable first fixed FTD and FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1.

·        CVE-2026-20330 — Cisco Secure Firewall ASA, Secure FTD, and Secure FMC structured-message or data-validation weakness, CWE-707. Coverage requires affected Cisco product and release validation plus product-specific message, parser, process, service, management, network, and incident-response evidence sufficient to distinguish malformed or unexpected data handling from consequential abuse. Cisco identifies ASA, FTD, and FMC as affected regardless of device configuration. Applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. Applicable first fixed FTD and FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1.

·        CVE-2026-20331 — Cisco Secure Firewall ASA, Secure FTD, and Secure FMC protection-mechanism weakness, CWE-693. Coverage requires affected Cisco product and release validation plus product-specific control, policy, configuration, process, management, network, and incident-response evidence sufficient to establish a consequential protection-mechanism failure. Cisco identifies ASA, FTD, and FMC as affected regardless of device configuration. Applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. Applicable first fixed FTD and FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1.

·        CVE-2026-20332 — Cisco Secure Firewall ASA, Secure FTD, and Secure FMC improper access control grouping, CWE-284, covering authorization, authentication, privileges, and bypasses. Coverage requires affected Cisco product and release validation plus product-specific authentication, authorization, privilege, policy, administrator, management, network, and incident-response evidence sufficient to distinguish vulnerable-state from consequential unauthorized access or control. Cisco identifies ASA, FTD, and FMC as affected regardless of device configuration. Applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. Applicable first fixed FTD and FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1. Cisco notes that two underlying vulnerabilities within this vulnerability class are actively exploited and directs customers to the separately disclosed FMC CVE-2026-20079 and CVE-2026-20316 advisories. This report does not classify CVE-2026-20332 itself as a known-exploited CVE.

·        CVE-2026-20333 — Cisco Secure Firewall ASA, Secure FTD, and Secure FMC security-relevant comparison weakness, CWE-697. Coverage requires affected Cisco product and release validation plus product-specific comparison, identity, authentication, authorization, policy, process, management, network, and incident-response evidence sufficient to establish a consequential security effect. Cisco identifies ASA, FTD, and FMC as affected regardless of device configuration. Applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. Applicable first fixed FTD and FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1.

·        CVE-2026-20334 — Cisco Secure Firewall ASA, Secure FTD, and Secure FMC improper adherence to coding standards, CWE-710. Coverage requires affected Cisco product and release validation plus product-specific process, service, configuration, system, management, network, and incident-response evidence sufficient to associate an observable security consequence with the underlying weakness. Cisco identifies ASA, FTD, and FMC as affected regardless of device configuration. Applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. Applicable first fixed FTD and FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1.

·        CVE-2026-20335 — Cisco Secure Firewall ASA, Secure FTD, and Secure FMC incorrect-calculation weakness, CWE-682, involving unintended results used in security-critical decisions or resource management. Coverage requires affected Cisco product and release validation plus product-specific decision-state, process, resource, service-health, management, network, and incident-response evidence sufficient to establish a consequential security effect. Cisco identifies ASA, FTD, and FMC as affected regardless of device configuration. Applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. Applicable first fixed FTD and FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1.

·        CVE-2026-20336 — Cisco Secure Firewall ASA, Secure FTD, and Secure FMC improper control of a resource through its lifetime, CWE-664, covering uninitialized variables, null pointers, and resource-lifecycle issues. Coverage requires affected Cisco product and release validation plus product-specific process, service-health, crash, resource, management, network, and incident-response evidence sufficient to distinguish ordinary operational instability from consequential abuse. Cisco identifies ASA, FTD, and FMC as affected regardless of device configuration. Applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. Applicable first fixed FTD and FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1.

·        CVE-2026-85103 — Check Point Quantum Security Gateway and Quantum Security Management heap-based buffer overflow in VPN certificate ASN.1 decoding. Coverage requires affected Check Point product and version context; VPN certificate-processing and ASN.1-decoding evidence where available; inbound VPN negotiation and certificate context; process, crash, memory-corruption, execution, network, management, and incident-response telemetry; and sufficient correlation to distinguish vulnerable-state or malformed certificate handling from successful exploitation. Check Point identifies R82.10 with Jumbo Hotfix Take 43 or below, R82 with Jumbo Hotfix Take 125 or below, and R81.20 with Jumbo Hotfix Take 165 or below as affected. The vulnerability is remotely reachable without authentication, is rated Critical with CVSS 9.8, and may permit arbitrary code execution on affected Quantum Security Gateway and Quantum Security Management systems. Check Point reports no indication of active exploitation.

·        CVE-2026-78626 — Okta Access Gateway Protected Rule authorization bypass. Coverage requires affected Okta Access Gateway product and version context; confirmation that a Protected Rule is configured on an application resource; authenticated application-user identity and low-privilege context; relevant request and authorization evidence; protected-resource mapping; downstream application-access evidence; and incident-response findings sufficient to distinguish authorized application access from exploitation. Affected versions are before 2026.9.1. Okta reports no known exploitation, and current authoritative evidence does not establish CISA KEV status.

·        FortiBleed campaign/procedure set — Coverage With Adaptation for the FBI and U.S. Secret Service-reported global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Documented procedures include exposed-device reconnaissance, credential stuffing, password spraying, reuse of compromised credentials, authentication-material and password-hash collection, unauthorized administrator-account creation or modification, legitimate-administrator lockouts, persistence, internal discovery, lateral-access attempts, and downstream ransomware-enablement activity. Existing S25 behavioral detections can identify suspicious gateway authentication, failed-to-success authentication sequences, unauthorized administrative activity, configuration changes, unexplained gateway-originated authentication, abnormal internal communication, endpoint activity, and downstream enterprise compromise when the required telemetry is available. Reliable FortiBleed-specific assessment requires FortiGate product and deployment context, historical internet exposure, administrative and SSL VPN authentication records, account creation and modification events, lockout evidence, VPN and administrative session activity, configuration changes, credential-use correlation, firewall and network-flow telemetry, internal authentication and discovery activity, and incident-response findings. These behaviors do not independently establish FortiBleed attribution or compromise of a specific FortiGate deployment. FortiBleed is registered as one non-CVE campaign/procedure set and does not alter the existing CVE or KEV registers. No new generic S25 detection rule, S13 expansion, S21–S25 modification, or S26 change is required.

·        ARMORY CASTLE / SAWFLY / BARECLAW activity — Covered with adaptation where local evidence links affected BeyondTrust Remote Support exploitation or appliance compromise to deployment of the SAWFLY PHP webshell, execution of the BARECLAW SOCKS5-over-WebSocket tunneler, SUID-enabled privilege escalation, credential-vault access attempts, persistence through startup scripts or privileged configuration, HAProxy routing manipulation, administrative permission changes, remote-support session abuse, internal reconnaissance, lateral movement, file transfers, log deletion, or correlated downstream identity and infrastructure activity. Reliable coverage requires BeyondTrust appliance-specific product, version, process, filesystem, configuration, privileged-execution, credential-vault, support-session, network, downstream-access, and forensic evidence beyond the existing S25 implementation. Published SAWFLY and BARECLAW YARA signatures may identify accessible malware artifacts but are not behavioral detections and do not independently prove exploitation, execution, or attribution. The ARMORY CASTLE campaign and associated SAWFLY and BARECLAW malware procedures are represented together as one adapted procedure set to prevent duplicate campaign accounting. The association with suspected PRC-nexus espionage activity reflects Mandiant's reporting and does not independently establish attribution of a local incident.

·        PoisonedRefresh / F5 BIG-IP APM c05d5254 rootkit and memory-only PHP web-shell activity — Covered with adaptation where local evidence links affected BIG-IP APM exploitation or unauthorized root-level execution to infection or modification of /usr/sbin/httpd, persistence into BIG-IP upgrade images, SELinux-related modification, custom ELF loading or early-process execution, Apache APR module-loader hooking, libphp memory manipulation, in-memory modification of legitimate APM webtop PHP content, suspicious HTTP interaction with the affected webtop paths, creation or use of /run/bigtlog.pipe, /bin/bash execution from appliance-local context, credential or session exposure, internal access, persistence, or other downstream effects. Reliable coverage requires runtime, memory, process, filesystem, appliance, network, and forensic context because the malicious PHP web shell can be present in memory while the corresponding on-disk PHP files remain unchanged.

·        CVE-2026-78135 — strongSwan libcharon CREATE_CHILD_SA handling on unestablished IKE SAs. Coverage requires affected strongSwan version context, IKEv2 and IKE SA establishment state, CREATE_CHILD_SA request and response evidence where available, Child SA creation and tunnel state, source and peer identity, authentication-completion state, network-flow and firewall evidence, downstream access, and incident-response findings sufficient to determine whether an unauthenticated peer established a usable Child SA before authentication completed.

·        CVE-2026-78134 — strongSwan EAP-PEAP / EAP-TTLS inner-authentication identity-propagation vulnerability. Coverage requires affected strongSwan version and plugin context, EAP method configuration, outer and inner identity telemetry, successful credential-authentication evidence, IKE/EAP identity mapping, authorization state, virtual-IP assignment, uniqueness checks, VPN-session state, authentication-server evidence where applicable, and downstream-access correlation sufficient to distinguish legitimate authenticated access from identity-binding or authorization abuse.

·        CVE-2026-78133 — strongSwan libcharon IKEv2 Multi-KE rekey-collision use-after-free with potential remote code execution. Coverage requires affected strongSwan version, authenticated-peer context, IKEv2 and Multi-KE configuration, IKE or Child SA rekey state, collision and task-failure evidence where available, daemon-health, crash or undefined-behavior evidence, process or execution telemetry, network context, and incident-response findings sufficient to associate an authenticated peer with exploitation.

·        CVE-2026-78132 — strongSwan x509 plugin ietfAttrSyntax parsing vulnerability causing an infinite loop and denial of service. Coverage requires affected strongSwan version and x509 plugin context, X.509 attribute-certificate processing evidence, certificate provenance where available, service-health and CPU or processing impact, daemon fault or restart evidence, network context, and incident-response findings sufficient to associate attacker-controlled certificate input with service impact.

·        CVE-2026-78131 — strongSwan x509 plugin attribute-certificate identity-parsing vulnerability causing memory exhaustion. Coverage requires affected version and x509 plugin context, attribute-certificate input and identity-processing evidence where available, daemon memory utilization, service-health, crash or restart telemetry, certificate provenance, network activity, and incident-response findings sufficient to distinguish exploitation from ordinary memory pressure.

·        CVE-2026-78130 — strongSwan x509 plugin X.509 attribute-certificate validation null-pointer vulnerability. Coverage requires affected strongSwan version and x509 plugin context, attribute-certificate validation evidence where available, issuer-field and certificate context, daemon crash or restart telemetry, service-health, network evidence, and incident-response findings sufficient to associate malformed certificate input with service impact.

·        CVE-2026-78129 — strongSwan libstrongswan encrypted PKCS#7 processing vulnerability. Coverage requires affected version, IKEv1 and PKCS#7 processing context where applicable, encrypted PKCS#7 input evidence where retained, cryptographic parameter context, processing-thread or service-health telemetry, crash or resource-exhaustion evidence, network activity, and incident-response findings sufficient to associate attacker-controlled input with denial of service.

·        CVE-2026-78127 — strongSwan libcharon IKE-message stringification memory-leak vulnerability. Coverage requires affected version, IKE-message and logging context, daemon memory utilization and service-health telemetry, repeated suspicious or malformed IKE activity, process or restart evidence, network correlation, and incident-response findings sufficient to associate attacker-controlled activity with progressive memory exhaustion.

·        CVE-2026-78126 — strongSwan eap-aka plugin unexpected AKA-Synchronization-Failure null-pointer vulnerability. Coverage requires affected version and eap-aka plugin use, EAP-AKA negotiation and message context, unexpected synchronization-failure evidence where available, daemon crash or restart telemetry, authentication-session evidence, network context, and incident-response findings sufficient to distinguish exploitation from ordinary authentication failure.

·        CVE-2026-78124 — strongSwan OpenSSL-plugin PKCS#7 certificate-enumeration memory-leak vulnerability. Coverage requires affected strongSwan version, OpenSSL-plugin use, IKEv1 acceptance where relevant, PKCS#7 certificate payload evidence, certificate enumeration and container context where available, daemon memory utilization and service-health telemetry, repeated suspicious input, and incident-response findings sufficient to associate attacker-controlled PKCS#7 processing with memory exhaustion.

·        CVE-2026-78123 — strongSwan OpenSSL-plugin PKCS#7 signerInfo / recipientInfo processing vulnerability. Coverage requires affected strongSwan version, OpenSSL-plugin use, PKCS#7 processing and certificate-payload context, daemon crash or undefined-memory-access evidence, service-health or restart telemetry, network activity, and incident-response findings sufficient to associate malformed PKCS#7 input with exploitation.

·        CVE-2026-84732 — OpenVPN reliability-layer vulnerability involving unbounded TLS timeout and invalid ACK handling. Coverage requires affected OpenVPN platform and version context, TLS and connection-state evidence, service fault or restart telemetry, network flow, process or service health, and incident-response evidence sufficient to distinguish malicious or malformed input from ordinary connection failure or service instability.

·        CVE-2026-84256 — OpenVPN Windows CreateProcess() quoting and argument-parsing vulnerability in a validation-script plus rogue-CA scenario. Coverage requires Windows OpenVPN platform and version context, validation-script configuration, CA and certificate-subject evidence, process and command-line telemetry, parent-child relationships, service context, authentication and session evidence, file and path context, and incident-response findings sufficient to associate a crafted certificate subject with unauthorized command execution.

·        CVE-2026-84226 — OpenVPN Windows tapctl unqualified netsh.exe invocation and binary-planting path. Coverage requires Windows OpenVPN and tapctl version context, netsh.exe path and provenance, executable search-path visibility, file creation and modification evidence, process lineage, service or administrative context, network-configuration activity, and incident-response findings sufficient to distinguish malicious binary planting from legitimate network administration.

·        CVE-2026-82312 — OpenVPN Windows system-object permission vulnerability affecting certain non-iservice or automatic-service configurations. Coverage requires affected OpenVPN service-mode and version context, Windows system-object and permission evidence where available, service-control and IPC telemetry, fault or denial-of-service evidence, process or service health, and incident-response findings sufficient to associate unauthorized local interaction with service disruption.

·        CVE-2026-78221 — OpenVPN Windows openvpnserv NRPT domain-size handling vulnerability involving UTF-8 IDNs and a buffer overread. Coverage requires affected Windows OpenVPN version context, NRPT and domain-configuration evidence, openvpnserv process and fault telemetry, input and configuration context where retained, service restart or crash evidence, and incident-response findings sufficient to distinguish malicious malformed input from ordinary service failure.

·        CVE-2026-78043 — OpenVPN Windows Interactive Service configuration-path validation bypass using /. Coverage requires affected OpenVPN version and Interactive Service context, submitted configuration path, file and directory provenance, service or process execution telemetry, authentication and local-user context, configuration-use evidence, and incident-response findings sufficient to associate an unauthorized configuration path with execution.

·        CVE-2026-81738 — OpenVPN Windows DHCP DOMAIN-SEARCH handling off-by-one vulnerability. Coverage requires affected OpenVPN version context, DHCP option and network-configuration evidence where available, OpenVPN process and memory-fault or crash telemetry, tunnel and session context, network evidence, and incident-response findings sufficient to associate crafted DOMAIN-SEARCH input with process impact.

·        CVE-2026-19318 — WatchGuard Fireware OS pre-authentication stack buffer overflow in iked. Coverage requires affected Fireware asset and version context, IKE_SA_INIT and IKE_AUTH visibility where available, EAP-MSCHAPv2 and IKE payload context where available, iked daemon-health and crash/respawn evidence, IKE payload diagnostic-logging configuration state, appliance system evidence, network telemetry, and incident-response findings sufficient to associate suspicious inbound IKE activity with exploitation. Exploitation requires IKE payload diagnostic logging to be enabled. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-19315 — WatchGuard Fireware OS pre-authentication type confusion in iked. Coverage requires affected Fireware asset and version context, suspicious IKE_AUTH activity, iked daemon-health and crash/respawn evidence, appliance system and process evidence where available, network telemetry, and incident-response findings sufficient to associate attacker-controlled IKE traffic with the out-of-bounds read, invalid-free, memory-corruption, denial-of-service, or potential remote-code-execution pathway. WatchGuard states that it is not aware of exploitation in the wild.

·        CVE-2026-19313 — WatchGuard Fireware OS pre-authentication heap buffer overflow in iked. Coverage requires affected Fireware asset and version context, suspicious inbound IKE traffic, iked daemon-health and crash/respawn evidence, appliance system and process evidence where available, network telemetry, and incident-response findings sufficient to associate attacker-controlled network traffic with heap corruption, denial of service, or potential remote code execution. WatchGuard states that it is not aware of exploitation in the wild.

·        Fire Ant trusted-infrastructure compromise activity — Covered with adaptation where observable behavior includes Cisco IOS XR or comparable router compromise, covert routing or tunneling behavior, traffic collection, operational-state or command-output manipulation, selective logging suppression, TACACS or comparable authentication-session interception, credential collection, Linux management-host persistence, custom SSH or packet-triggered access, security-tool or service masquerading, and evidence manipulation. Reliable coverage requires router-specific configuration and operational-state evidence, authentication-server process and session visibility, Linux management-host process, file, persistence, network, and forensic telemetry, and independent cross-validation when individual evidence sources may have been manipulated. Fire Ant should not be represented as definitively equivalent to UNC3886 solely on reported behavioral overlap.

·        CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Remote Access SSL VPN denial-of-service vulnerability. Coverage requires Cisco-specific affected-product and version identification, vulnerable Remote Access SSL VPN or related listening configuration, crafted HTTP-request evidence where available, appliance system and health telemetry, unexpected reload or availability evidence, network context, and incident-response findings sufficient to associate suspicious inbound activity with exploitation. Cisco states that PSIRT became aware of active exploitation in August 2026. CISA added CVE-2026-20349 to KEV on August 11, 2026.

·        INC ransomware activity following SonicWall SMA1000 exploitation — Covered with adaptation where evidence shows gateway compromise, credential exposure, session or TOTP material exposure, gateway-originated authentication, endpoint access, internal expansion, ransomware preparation, data access, or extortion pressure tied to the affected gateway, account, session, source, destination, endpoint, or investigation window.

·        CVE-2026-16232 — Check Point SmartConsole authentication bypass and full administrative access require management-server, SmartConsole, application-token, administrator-authentication, Trusted Client, security-policy, configuration, policy-publication, policy-installation, managed-gateway, network, identity, change-control, and forensic telemetry.

·        CVE-2026-50751 — Check Point Security Gateway Remote Access VPN and Mobile Access IKEv1 authentication bypass. Coverage requires affected Check Point gateway and version context; Remote Access VPN or Mobile Access enablement; deprecated IKEv1 use; legacy Remote Access client acceptance; machine-certificate requirements; IKE negotiation and authentication telemetry; VPN-session records; user, source, gateway, and session attribution; downstream identity, network, endpoint, and cloud activity; hotfix and configuration state; and incident-response evidence sufficient to distinguish authorized remote access from an unauthenticated authentication-bypass-created VPN session. Check Point confirms active exploitation beginning May 7, 2026 and reports increased activity in early June. CISA added CVE-2026-50751 to KEV in June 2026.

·        Qilin ransomware-affiliate activity following Check Point CVE-2026-50751 exploitation — Covered with adaptation where locally observed behavior includes unauthorized IKEv1 VPN-session establishment, access without expected authentication evidence, internal discovery, endpoint access, attempts to retrieve actor-controlled ELF payloads, credential or identity use, lateral movement, data access, ransomware preparation, or ransomware execution tied to the affected Check Point gateway, account, source, session, endpoint, or investigation window. Check Point reports confirmed post-compromise activity associated with a Qilin ransomware affiliate in one case and assesses with medium confidence that the observed actor was financially motivated and associated with Qilin-related activity. This does not justify universal Qilin attribution.

·        CVE-2025-53521 — F5 BIG-IP APM unauthenticated remote code execution. Coverage requires affected BIG-IP APM product and exact-version context; confirmation that an APM access policy is configured on an affected virtual server; inbound request and TMM context where retained; Apache, PHP, process, service, memory, filesystem, and network telemetry; relevant F5 compromise-assessment artifacts; and incident-response findings sufficient to distinguish vulnerable-state or ordinary APM activity from successful unauthenticated execution. F5 confirmed exploitation, and CISA added CVE-2025-53521 to KEV on March 27, 2026.

·        CVE-2025-14733 — WatchGuard Fireware OS iked out-of-bounds write. Coverage requires affected Fireware asset and version context; mobile-user VPN using IKEv2 or branch-office VPN using IKEv2 with a dynamic gateway peer; historical configuration state where the documented stale-configuration condition may apply; inbound IKE activity and protocol evidence; iked daemon-health and crash/respawn evidence; appliance system and process evidence where available; memory-corruption or execution evidence; network and downstream telemetry; and incident-response findings sufficient to associate suspicious unauthenticated IKE activity with exploitation. WatchGuard states that a remote unauthenticated attacker may be able to execute arbitrary code. CISA identifies CVE-2025-14733 as used in known ransomware campaigns. Current authoritative evidence does not identify a specific ransomware family.

·        Akira ransomware activity following SonicWall access — Covered with adaptation where locally observed behavior includes unauthorized SonicWall VPN access, account or credential abuse, endpoint execution, internal discovery, lateral movement, security-control interference, backup disruption, virtualization-infrastructure targeting, or ransomware execution tied to the affected gateway, account, session, endpoint, or investigation window.

·        OVERSTEP appliance malware requires vendor-specific file-integrity, process, startup, preload, persistence, credential-access, session-database, log-integrity, and outbound-communication telemetry.

·        UNC6148 procedures require appliance-compromise evidence, OVERSTEP-related persistence and modification visibility, credential and OTP-seed exposure assessment, session-use correlation, victimology, infrastructure, and incident-specific intelligence.

·        CVE-2025-32819 — SMA100 privileged file deletion requires vendor-specific file-deletion, object, account, administrative, and privilege-state telemetry.

·        CVE-2025-32820 — SMA100 path traversal and directory-permission manipulation require file, path, permission, ownership, configuration, persistence, or execution telemetry.

·        CVE-2025-32821 — SMA100 command-argument injection and attacker-controlled file placement require administrative-command, upload, path, file-creation, execution, service, or downstream telemetry.

·        CVE-2025-23006 — SMA1000 pre-authentication deserialization and root-level command execution require appliance audit, process, service, system, network, identity, or downstream telemetry when proxy, hotfix, path, or configuration events are absent.

·        CVE-2024-40766 — SonicOS improper access control requires VPN-session, user, device, source, authentication, endpoint, internal-network, and ransomware-follow-on correlation.

·        CVE-2024-38475 — Apache path-handling exploitation and sensitive appliance-database access require web-request, path, file-access, database-access, export, session, cookie, account, source, and downstream behavioral correlation.

·        CVE-2021-20016 — SMA100 SQL injection and authentication bypass require web, database, authentication, administrative, session, configuration, and downstream telemetry.

·        Appliance-local code execution without administrative, configuration, process, file, service, network, identity, endpoint, or cloud evidence requires memory, forensic, runtime, service, or vendor-specific appliance telemetry.

·        Unauthorized security-management access without management-server, SmartConsole, application-token, administrator, Trusted Client, policy-change, policy-publication, policy-installation, managed-gateway, network, identity, or forensic evidence requires vendor-specific management-plane telemetry and post-incident validation.

·        Session theft or cookie reuse requires reliable session identifiers, user and device mapping, source history, concurrent-session baselines, revocation records, and downstream authentication correlation.

·        Credential, certificate, token, application-token, session-database, or TOTP-seed theft requires direct resource-access telemetry, forensic evidence, subsequent use, or a justified exposure determination.

·        Cloud activity requires provider-specific sign-in, source-address, principal, role, token, user-agent, resource, and approved-automation mappings.

·        Malware and adversary procedures that use approved service accounts, existing sessions, common management protocols, expected destinations, or legitimate administrative tools require stronger identity, device, process, change-control, and bounded-time correlation.

Non-Coverage Conditions

Non-coverage applies where activity does not produce observable proxy-to-local-service behavior, successful connection state, validated RRAS service-context execution, credible Okta Access Gateway authorization-bypass evidence, credible Check Point authentication-bypass or unauthorized VPN-session evidence, credible Cisco Remote Access SSL VPN exploitation evidence, credible OpenVPN exploitation or abuse evidence, credible strongSwan exploitation, authentication-boundary, identity-binding, Child SA, execution, or service-impact evidence, credible WatchGuard iked exploitation evidence, unauthorized administrative modification, unauthorized SmartConsole or management-server access, application-token activity, security-policy or configuration change, unexplained gateway-originated authentication, suspicious endpoint execution, abnormal internal access, or correlated cloud activity.

Non-coverage applies when activity remains limited to:

·        CVE-2026-107406 inferred solely from affected NetScaler product or version, SAML SP or SAML IdP configuration, internet exposure, public vulnerability reporting, or scanning without sufficient SAML, authentication, gateway-request, process, memory, execution, service-health, crash or restart, appliance, network, downstream-access, or incident-response evidence to support exploitation or compromise.

·        CVE-2026-88779 inferred solely from affected NetScaler product or version, SAML SP or SAML IdP configuration, internet exposure, CISA KEV status, public reporting, or scanning without sufficient SAML, authentication, gateway, service-health, crash or restart, memory, appliance, network, or incident-response evidence.

·        CVE-2026-94127 inferred solely from F5 BIG-IP APM product presence, affected-version state, an APM access policy and OAuth profile configured on a virtual server, internet exposure, F5 active-exploitation reporting, public reporting, or scanning without sufficient request, OAuth, TMM, process, memory, service, network, appliance, or incident-response evidence. The CVE should not be represented as management- or control-plane compromise because F5 identifies it as a data-plane issue with no control-plane exposure.

·        CVE-2026-78626 inferred solely from Okta Access Gateway product presence, an affected version, a configured Protected Rule, public advisory reporting, or ordinary authenticated application access without sufficient user, privilege, request, authorization, protected-resource, downstream-access, or incident-response evidence.

·        CVE-2025-53521 inferred solely from F5 BIG-IP APM product presence, affected-version state, an APM access policy on a virtual server, internet exposure, F5 active-exploitation reporting, CISA KEV status, public reporting, or scanning without sufficient request, TMM, Apache, PHP, process, memory, filesystem, service, network, or incident-response evidence.

·        PoisonedRefresh, Linux/Agnt-IC, or F5 c05d5254 naming; the presence of the legitimate apm_css.php3, full_wt.php3, or webtop_popup_css.php3 files; a clean hash of those on-disk PHP files; public malware hashes, request markers, keys, paths, or other static indicators; or one isolated Apache/PHP anomaly without corroborating runtime-memory, httpd-integrity, upgrade-image, UNIX-socket, shell, persistence, network, or forensic evidence.

·        Vulnerable or unpatched gateway firmware, Windows RRAS software state, Check Point Security Gateway version or IKEv1 configuration state, Cisco ASA or FTD software state, OpenVPN package or version state, strongSwan package or version state, Fireware OS version state, SonicWall SMA1000 platform-hotfix state, hotfix, appliance, web server, SSL VPN service, management server, SmartConsole environment, or platform state.

·        CVE identifiers, scanner findings, firmware-version findings, operating-system-version findings, Check Point version or configuration findings, Cisco version findings, OpenVPN-version findings, strongSwan-version findings, management-server-version findings, exposure-management records, or KEV status without behavioral evidence.

·        Internet-accessible RRAS services, exposed Check Point Remote Access or Mobile Access services, exposed Cisco Remote Access SSL VPN services, exposed OpenVPN services, exposed strongSwan IKE services, exposed IKE services, Management Server IP addresses, or unrestricted Trusted Client configurations without evidence of suspicious execution, unauthorized VPN-session or Child SA establishment, service or daemon impact, identity-binding or authorization abuse, configuration misuse, token acquisition, unauthorized authentication, administrative activity, policy change, or downstream effect.

·        CVE-2026-50751 inferred solely from Check Point product presence, vulnerable software state, IKEv1 enablement, legacy-client acceptance, absent machine-certificate requirements, vendor active-exploitation reporting, CISA KEV status, public reporting, actor infrastructure, or scanning without sufficient IKE, VPN-session, user, source, authentication, gateway, downstream-access, or incident-response evidence.

·        Qilin ransomware attribution inferred solely from CVE-2026-50751 applicability, Check Point gateway presence, source-address overlap, public campaign reporting, or one suspicious VPN session without corroborating post-compromise, payload, endpoint, ransomware, infrastructure, or incident-response evidence.

·        CVE-2026-20349 inferred solely from affected Cisco ASA or FTD version, exposed Remote Access SSL VPN configuration, vendor active-exploitation reporting, CISA KEV status, public advisory reporting, or scanning without sufficient HTTP-request, appliance-health, reload, availability, network, or incident-response evidence.

·        CVE-2026-20329, CVE-2026-20330, CVE-2026-20331, CVE-2026-20332, CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, or CVE-2026-20336 inferred solely from affected Cisco Secure Firewall ASA, Secure FTD, or Secure FMC product or release state, hardening-advisory applicability, scanner findings, or public reporting without sufficient product-specific authentication, authorization, policy, message-processing, exception, comparison, process, service-health, resource, management, network, or incident-response evidence establishing consequential activity. The separate active-exploitation status of FMC CVE-2026-20079 and CVE-2026-20316 does not independently establish exploitation of any of these eight CVE groupings.

·        CVE-2026-84732, CVE-2026-84256, CVE-2026-84226, CVE-2026-82312, CVE-2026-78221, CVE-2026-78043, or CVE-2026-81738 inferred solely from affected OpenVPN version, platform, service presence, public advisory reporting, or scanning without sufficient service, process, configuration, certificate, path, IPC, DHCP, NRPT, fault, network, authentication, or incident-response evidence.

·        CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134, or CVE-2026-78135 inferred solely from affected strongSwan version, package presence, IKE exposure, plugin presence, public advisory reporting, or scanning without sufficient PKCS#7, certificate, X.509, EAP, IKE SA, Child SA, CREATE_CHILD_SA, rekey, Multi-KE, peer-authentication, daemon-health, process, network, authentication, or incident-response evidence.

·        CVE-2026-78135 inferred solely from an exposed strongSwan IKEv2 service or one observed CREATE_CHILD_SA request without evidence that the request was processed on an unestablished IKE SA, that authentication had not completed, and that a usable Child SA was actually created.

·        CVE-2026-78134 inferred solely from EAP-PEAP or EAP-TTLS enablement, an outer/inner identity difference, or a successful EAP authentication without evidence of incorrect identity binding, unauthorized authorization state, unexpected virtual-IP assignment, uniqueness effects, or downstream access.

·        CVE-2026-78133 inferred solely from strongSwan 6.0.x presence, an authenticated IKEv2 peer, Multi-KE support, or rekey traffic without sufficient collision, daemon-health, crash, undefined-behavior, process, execution, or forensic evidence.

·        SonicWall SMA1000 CVE-2026-83548 or CVE-2026-83549 inferred solely from affected model, affected platform-hotfix version, internet exposure, vendor active-exploitation reporting, CISA KEV status, public advisory reporting, or scanning without sufficient gateway, proxy, administrative, command-execution, configuration, network, identity, or incident-response evidence.

·        WatchGuard CVE-2026-19313, CVE-2026-19315, or CVE-2026-19318 inferred solely from affected Fireware version, internet exposure, IKE service availability, public advisory reporting, or scanning without sufficient IKE, iked daemon-health, appliance, network, or incident-response evidence.

·        CVE-2025-14733 inferred solely from affected Fireware OS version, current or historical IKEv2 configuration, internet exposure, IKE service availability, WatchGuard advisory reporting, CISA KEV status, CISA known-ransomware-campaign-use designation, public reporting, or scanning without sufficient IKE, iked daemon-health, crash/respawn, appliance, execution, network, downstream, or incident-response evidence.

·        Ransomware-family attribution inferred solely from CVE-2025-14733 applicability, exploitation, KEV status, or CISA's known-ransomware-campaign-use designation without independent evidence identifying a specific ransomware family or activity set.

·        A Check Point IKEv1 connection, VPN session, authentication anomaly, or legacy-client event without sufficient affected-configuration, user, source, certificate, session, gateway, and downstream context to distinguish exploitation from authorized remote access or operational behavior.

·        A Cisco ASA or FTD reload without sufficient Remote Access SSL VPN exposure, surrounding HTTP or network activity, affected-version context, device-health history, and incident-response evidence to distinguish exploitation from administrative action, software defect, resource exhaustion, power disruption, or other operational failure.

·        OpenVPN service crashes, restarts, malformed configuration events, NRPT faults, DHCP-related faults, IPC issues, or service disruption without sufficient affected-version, input, process, service-mode, configuration, and incident-response context to distinguish exploitation from operational failure.

·        strongSwan service crashes, restarts, high-memory conditions, EAP errors, certificate-processing faults, IKE negotiation failures, Child SA creation, rekey events, or service disruption without sufficient affected-version, plugin, protocol, authentication-state, input, peer, process, network, and incident-response context to distinguish exploitation from operational behavior.

·        An iked crash, termination, or automatic respawn without sufficient inbound IKE context, affected-version context, surrounding appliance activity, or incident-response evidence to distinguish exploitation from operational failure.

·        IKE payload diagnostic logging being enabled without suspicious IKE_AUTH activity or other evidence relevant to CVE-2026-19318.

·        Public proof-of-concept availability, source IP addresses, exploit strings, request paths, filenames, hashes, indicators, advisories, KEV listings, ransomware-family names, affiliate names, or actor names without local activity.

·        Failed or malformed requests that produce no successful connection, RRAS execution, unauthorized VPN session, unauthorized Child SA, identity-binding or authorization effect, Cisco device impact, OpenVPN execution or service impact, strongSwan service impact or execution, appliance-local access, credible iked exploitation evidence, management-server access, gateway modification, security-policy modification, identity use, or downstream effect.

·        Generic svchost.exe activity without validated RemoteAccess service attribution.

·        RRAS service faults, restarts, or recovery events without suspicious surrounding activity.

·        Suspicious child-process execution that cannot be attributed to the active RemoteAccess service process.

·        Local-only RRAS exploitation paths that do not produce the externally sourced network behavior required by the S25 RRAS rules.

·        Memory-only RRAS, strongSwan, or appliance exploitation that produces no observable child process, daemon impact, network, service, authentication, session, endpoint, appliance, or downstream effect.

·        OpenVPN validation-script execution, netsh.exe execution, tapctl activity, Interactive Service configuration use, NRPT processing, DHCP DOMAIN-SEARCH processing, or service-object activity without sufficient affected-version, ancestry, file, certificate, configuration, user, service-mode, process, or bounded-investigation context to distinguish malicious activity from legitimate administration.

·        strongSwan PKCS#7, X.509, EAP, IKE SA, Child SA, CREATE_CHILD_SA, rekey, or Multi-KE activity without sufficient affected-version, plugin, peer, identity, authentication, service-health, process, network, session, and bounded-investigation context to distinguish exploitation from legitimate protocol operation.

·        Successful WebSocket or protocol-upgrade events where the connected destination and follow-on activity are unknown.

·        Application-token creation or use that cannot be distinguished from approved SmartConsole or administrative activity.

·        Appliance-local execution that produces no observable administrative, configuration, process, file, service, network, identity, endpoint, or cloud effect.

·        Unauthorized management-plane access that produces no observable administrator, SmartConsole, application-token, Trusted Client, security-policy, configuration, publication, installation, managed-gateway, network, identity, or forensic evidence.

·        Session, cookie, token, application-token, certificate, credential, session-database, or TOTP-seed theft that produces no direct access evidence, forensic finding, or observable subsequent use.

·        Valid VPN, RRAS, OpenVPN, strongSwan, SmartConsole, administrator, or service-account activity that cannot be distinguished from approved remote access, directory integration, monitoring, support, backup, security administration, or management activity.

·        Endpoint, internal-network, cloud, or ransomware activity that cannot be tied to the affected gateway, RRAS host, VPN gateway, OpenVPN host where applicable, strongSwan endpoint where applicable, management server, administrator, account, session, source, destination, policy, managed gateway, or investigation window.

·        Appliance malware or rootkit behavior where file, process, startup, persistence, log-integrity, credential-access, and outbound telemetry are unavailable.

·        Malware-family, campaign, ransomware-family, affiliate, or actor names without observable procedures.

·        Environments where requested destinations, connection results, gateway, RRAS, VPN, OpenVPN, strongSwan, or management-server identity, Check Point product, IKEv1, legacy-client, machine-certificate, VPN-session, Cisco product, SSL VPN, device-health, reload, OpenVPN platform, version, service mode, certificate, configuration, path, process, IPC, NRPT, DHCP, fault, service-control context, strongSwan version, plugin, PKCS#7, X.509, EAP, IKE SA, Child SA, CREATE_CHILD_SA, rekey, Multi-KE, peer-authentication or service-health context where required, Fireware version and IKE context where required, iked health or diagnostic-logging state where required, RemoteAccess service-process attribution, process ancestry, administrative events, SmartConsole records, application-token activity, Trusted Client history, policy revisions, policy-publication or policy-installation records, VPN-session records, service-account mapping, workstation names, endpoint telemetry, internal-network attribution, cloud logs, approved exceptions, or required retention are unavailable.

Current Coverage Count

Directly Covered CVEs: 54

·        CVE-2026-83549

·        CVE-2026-83548

·        CVE-2026-26111

·        CVE-2026-25173

·        CVE-2026-25172

·        CVE-2026-20868

·        CVE-2026-15410

·        CVE-2026-15409

·        CVE-2025-64678

·        CVE-2025-62549

·        CVE-2025-62452

·        CVE-2025-54113

·        CVE-2025-50164

·        CVE-2025-50163

·        CVE-2025-49670

·        CVE-2025-49669

·        CVE-2025-48824

·        CVE-2025-40595

·        CVE-2025-33066

·        CVE-2025-33064

·        CVE-2025-24051

·        CVE-2025-2170

·        CVE-2025-21410

·        CVE-2025-21208

·        CVE-2024-49125

·        CVE-2024-49102

·        CVE-2024-49089

·        CVE-2024-49086

·        CVE-2024-49085

·        CVE-2024-43611

·        CVE-2024-43607

·        CVE-2024-43593

·        CVE-2024-43564

·        CVE-2024-43549

·        CVE-2024-43453

·        CVE-2024-38265

·        CVE-2024-38212

·        CVE-2024-38154

·        CVE-2024-38130

·        CVE-2024-38121

·        CVE-2024-30029

·        CVE-2024-30024

·        CVE-2024-30022

·        CVE-2024-30015

·        CVE-2024-30014

·        CVE-2024-30009

·        CVE-2024-26205

·        CVE-2024-26200

·        CVE-2024-26179

·        CVE-2023-44221

·        CVE-2023-35367

·        CVE-2023-35366

·        CVE-2023-35365

·        CVE-2021-20035

CVEs Covered With Adaptation: 76

·        CVE-2026-102764

·        CVE-2026-104935

·        CVE-2026-107406

·        CVE-2026-102258

·        CVE-2026-102257

·        CVE-2026-102256

·        CVE-2026-102255

·        CVE-2026-88779

·        CVE-2026-86134

·        CVE-2026-86104

·        CVE-2026-18145

·        CVE-2026-13046

·        CVE-2026-86101

·        CVE-2026-86133

·        CVE-2026-13224

·        CVE-2026-86132

·        CVE-2026-86105

·        CVE-2026-90441

·        CVE-2026-86131

·        CVE-2026-86136

·        CVE-2026-81433

·        CVE-2026-86128

·        CVE-2026-18105

·        CVE-2026-88771

·        CVE-2026-88772

·        CVE-2026-88773

·        CVE-2026-88774

·        CVE-2026-88775

·        CVE-2026-88776

·        CVE-2026-88777

·        CVE-2026-88778

·        CVE-2026-94127

·        CVE-2026-85102

·        CVE-2026-20329

·        CVE-2026-20330

·        CVE-2026-20331

·        CVE-2026-20332

·        CVE-2026-20333

·        CVE-2026-20334

·        CVE-2026-20335

·        CVE-2026-20336

·        CVE-2026-85103

·        CVE-2026-78626

·        CVE-2026-78135

·        CVE-2026-78134

·        CVE-2026-78133

·        CVE-2026-78132

·        CVE-2026-78131

·        CVE-2026-78130

·        CVE-2026-78129

·        CVE-2026-78127

·        CVE-2026-78126

·        CVE-2026-78124

·        CVE-2026-78123

·        CVE-2026-84732

·        CVE-2026-84256

·        CVE-2026-84226

·        CVE-2026-82312

·        CVE-2026-78221

·        CVE-2026-78043

·        CVE-2026-81738

·        CVE-2026-19318

·        CVE-2026-19315

·        CVE-2026-19313

·        CVE-2026-20349

·        CVE-2026-16232

·        CVE-2026-50751

·        CVE-2025-53521

·        CVE-2025-14733

·        CVE-2025-32819

·        CVE-2025-32820

·        CVE-2025-32821

·        CVE-2025-23006

·        CVE-2024-40766

·        CVE-2024-38475

·        CVE-2021-20016

Total CVEs: 130

CVE-2026-94127 previously increased the CVEs Covered With Adaptation count from 44 to 45 and moved the total CVE coverage register from 98 to 99 entries. CVE-2026-88771 through CVE-2026-88778 added eight additional Coverage With Adaptation entries and moved the register to 54 Directly Covered / 53 Coverage With Adaptation / 107 total CVEs. The fifteen WatchGuard Fireware OS CVEs published on September 29-30, 2026 added fifteen Coverage With Adaptation entries and moved the register to 54 Directly Covered / 68 Coverage With Adaptation / 122 total CVEs. CVE-2026-88779 added one additional Coverage With Adaptation entry and moved the register to 54 Directly Covered / 69 Coverage With Adaptation / 123 total CVEs. The SonicWall SMA1000 SNWLID-2026-0017 cohort adds CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, and CVE-2026-102258 as four additional Coverage With Adaptation entries and moves the register to 54 Directly Covered / 73 Coverage With Adaptation / 127 total CVEs. Current authoritative evidence does not establish confirmed in-the-wild exploitation or CISA KEV status for the four SonicWall SNWLID-2026-0017 CVEs. WatchGuard states that it is not aware of exploitation in the wild for the fifteen newly added vulnerabilities, and current authoritative evidence does not establish CISA KEV status for that set. Citrix confirms observed exploitation of CVE-2026-88771 and CVE-2026-88772 against unmitigated deployments. CISA added both CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities Catalog on September 27, 2026, based on evidence of active exploitation. CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities Catalog on October 4, 2026, based on evidence of active exploitation. These exploitation and KEV states increase remediation, retrospective-hunting, and compromise-assessment urgency but do not change the Coverage With Adaptation classifications. CVE-2026-85102 remains an existing Coverage With Adaptation entry, so its confirmed exploitation state and September 22, 2026 CISA KEV designation do not change the CVE coverage count.

CVE-2026-107406 adds one additional Coverage With Adaptation entry to the Secure Remote-Access Gateway CVE register. The previous register contained 54 Directly Covered / 73 Coverage With Adaptation / 127 total CVEs. The addition increases Coverage With Adaptation to 74 and the total CVE count to 128 while preserving 54 Directly Covered CVEs. Current authoritative evidence does not establish confirmed exploitation in the wild or CISA KEV status for CVE-2026-107406. The new registration does not require additional generic S25 detection rules or change the existing ransomware, malware, or activity-group procedure-set count.

CVE-2026-104935 adds one additional Coverage With Adaptation entry to the Secure Remote-Access Gateway CVE register. The previous governing register contained 54 Directly Covered / 74 Coverage With Adaptation / 128 total CVEs. The addition increases Coverage With Adaptation to 75 and the total CVE count to 129 while preserving 54 Directly Covered CVEs. Ivanti confirms limited exploitation in the wild, and CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities Catalog on October 13, 2026, with an October 16, 2026 remediation deadline. The new registration preserves the existing ransomware, malware, and activity-group procedure-set count of 6 and does not require additional generic S25 detection rules.

CVE-2026-102764 adds one additional Coverage With Adaptation entry to the Secure Remote-Access Gateway CVE register. The previous governing register contained 54 Directly Covered / 75 Coverage With Adaptation / 129 total CVEs. The addition increases Coverage With Adaptation to 76 and the total CVE count to 130 while preserving 54 Directly Covered CVEs. Google Threat Intelligence Group / Mandiant documents confirmed zero-day exploitation beginning in late August 2026 involving ARMORY CASTLE and the associated SAWFLY and BARECLAW malware procedures. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities Catalog on October 16, 2026, confirming its KEV designation. This status change increases the KEV-confirmed population represented by the existing coverage register by one without adding another CVE, changing its Coverage With Adaptation classification, or altering the established malware and activity-group procedure-set counts. The ARMORY CASTLE / SAWFLY / BARECLAW procedure set adds one Coverage With Adaptation entry, increasing the ransomware, malware, or activity-group procedure-set count from 6 to 7. The vulnerability and campaign additions do not independently establish a missing generic S25 behavioral detection family, and the published YARA signatures remain artifact-based detection opportunities rather than behavioral detection rules. No additional S25 detection rules are required based solely on the validated intelligence represented in this amendment.

The October 16, 2026 FortiBleed amendment adds one non-CVE Coverage With Adaptation campaign/procedure set to the Secure Remote-Access Gateway register. The FBI and U.S. Secret Service identify FortiBleed as an active global credential-compromise campaign targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways, with observed credential attacks, unauthorized administrative activity, account lockouts, persistence, internal discovery, and ransomware-enablement implications. The addition increases the ransomware, malware, or activity-group procedure-set Coverage With Adaptation count from 7 to 8. The CVE register remains 54 Directly Covered / 76 Coverage With Adaptation / 130 total CVEs, with no change to existing CISA KEV accounting. The campaign is registered once and does not independently establish a missing generic S25 behavioral detection family. Existing gateway, VPN, identity, network, endpoint, and downstream behavioral detection capabilities remain applicable subject to FortiGate-specific telemetry, correlation, and attribution requirements.

Directly Covered Malware Procedure Sets: 0

·        None

Directly Covered APT or Activity-Group Procedure Sets: 0

·        None

Ransomware, Malware, or Activity-Group Procedure Sets Covered With Adaptation: 8

·        FortiBleed credential-compromise and remote-access gateway abuse activity

·        ARMORY CASTLE / SAWFLY / BARECLAW activity

·        PoisonedRefresh / F5 BIG-IP APM c05d5254 rootkit and memory-only PHP web-shell activity

·        Fire Ant trusted-infrastructure compromise activity

·        INC ransomware activity following SonicWall SMA1000 exploitation

·        Qilin ransomware-affiliate activity following Check Point CVE-2026-50751 exploitation

·        Akira ransomware activity following SonicWall access

·        UNC6148 procedures

The current CVE coverage state is 54 Direct / 76 Coverage With Adaptation / 130 total CVEs. The ransomware, malware, or activity-group procedure-set Coverage With Adaptation count is 8.

CVE-2025-53521 remains a known-exploited CVE and CISA KEV entry added on March 27, 2026. The September 2026 PoisonedRefresh technical analysis adds post-exploitation and detection-evasion context associated with affected BIG-IP APM environments.

CVE-2026-50751 remains Coverage With Adaptation. Qilin ransomware-affiliate activity following exploitation is treated separately as an adapted activity-group procedure set because attribution requires post-compromise evidence beyond the vulnerability itself.

CVE-2026-20349 remains Coverage With Adaptation. Cisco's active-exploitation statement and CISA's August 11, 2026 KEV designation increase remediation and investigation urgency.

CVE-2026-20329, CVE-2026-20330, CVE-2026-20331, CVE-2026-20332, CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, and CVE-2026-20336 are Coverage With Adaptation. These eight CVE groupings are not individually classified as known exploited in this report. Cisco states that two underlying vulnerabilities within the CWE-284 class represented by CVE-2026-20332 are actively exploited and directs customers to the separately disclosed FMC CVE-2026-20079 and CVE-2026-20316 advisories. Exploitation discussion therefore remains tied to CVE-2026-20079 and CVE-2026-20316 rather than being generalized to CVE-2026-20332 or the other seven hardening CVE groupings.

The strongSwan CVEs are not treated as known exploited or CISA KEV-listed because current authoritative evidence does not establish those states.

The fifteen WatchGuard Fireware OS vulnerabilities published on September 29-30, 2026 are Coverage With Adaptation under the existing remote-access-gateway and appliance behavior model. The existing S25 content can represent consequential unauthorized VPN access, gateway or management-service impact, administrative or configuration activity, command execution, file access, identity or authorization misuse, internal access, and downstream trust loss when those outcomes become observable. Reliable CVE-specific attribution, however, requires WatchGuard-specific product and fixed-release validation plus the applicable service, feature, privilege, protocol, process, file, session, network, and incident-response context. The new set spans the authentication process and wgagent login path, spamd, samld, SAML Access Portal authorization, iked, the WebUI management agent, the Access Portal reverse proxy, wgagent management API variants, BOVPN Over TLS client handling, fingerd DHCP processing, NetFlow IPv6 processing, and diagnostic tasks. CVE-2026-13046 additionally requires evidence of prior file-write capability; CVE-2026-86101 requires an authenticated SAML Access Portal user; CVE-2026-86132 requires the documented IKEv2 configuration and AES-GCM condition; CVE-2026-86131 requires attacker control of the remote BOVPN Over TLS server; CVE-2026-81433 requires adjacent network access; and the WebUI or management-API conditions require the applicable authenticated administrative or low-privileged account context. WatchGuard states that it is not aware of exploitation in the wild for the new set, and current authoritative evidence does not establish CISA KEV status for these fifteen CVEs.

CVE-2025-14733 remains Coverage With Adaptation. CISA's known-ransomware-campaign-use designation materially increases remediation, compromise-assessment, and retrospective-hunting urgency. Current authoritative evidence does not establish a specific ransomware family or distinct ransomware procedure set associated with the vulnerability.

Coverage Qualification

Coverage is strongest where suspicious external gateway, RRAS, VPN, or management-plane activity can be joined with a normalized requested destination, successful proxy or protocol-upgrade state, appliance-local target, validated RemoteAccess service-process attribution, suspicious child-process execution, unauthorized VPN-session establishment, unauthorized or pre-authentication Child SA establishment, unauthorized hotfix or configuration activity, traversal-path evidence, unauthorized SmartConsole authentication, application-token activity, Trusted Client exposure, unexpected administrator behavior, security-policy modification, policy publication or installation, unexpected gateway-originated authentication, absent or anomalous VPN-session context, meaningful service-account deviation, suspicious endpoint execution, abnormal internal-destination access, or correlated cloud activity.

Coverage With Adaptation is appropriate for CVE-2026-78626 because the existing behavior family represents identity-boundary bypass, authorization anomalies, trusted-access misuse, and downstream access consequences. Reliable Okta-specific attribution additionally requires Access Gateway version validation, Protected Rule configuration, application-user and privilege context, request and authorization evidence, protected-resource mapping, downstream access evidence, and incident-response validation. Okta reports no known exploitation, and current authoritative evidence does not establish CISA KEV status.

Coverage With Adaptation is appropriate for CVE-2025-53521 because the existing behavior family represents remote-access gateway compromise, network-reachable execution, unauthorized gateway activity, persistence, identity use, internal expansion, cloud access, and downstream trust loss. Reliable F5-specific attribution additionally requires BIG-IP APM product and version validation, APM access-policy state, request and TMM context, Apache and PHP runtime evidence, process and memory visibility, filesystem and upgrade-image integrity, service and network evidence, and incident-response validation. F5-confirmed exploitation and CISA KEV status increase urgency.

PoisonedRefresh / F5 c05d5254 activity remains Coverage With Adaptation because the existing behavior family can identify portions of the resulting appliance compromise and downstream activity, but direct identification of the documented memory-only web-shell mechanism and rootkit persistence requires additional BIG-IP APM, Apache, PHP, runtime-memory, httpd-integrity, upgrade-image, SELinux, UNIX-domain-socket, and forensic telemetry. Static indicators alone are insufficient to establish the documented activity.

Coverage With Adaptation is appropriate for the strongSwan 6.1.0 vulnerability set because the existing behavior family represents remote-access gateway abuse, IKE/VPN interaction, VPN-session and identity correlation, unexplained gateway-originated authentication, service and daemon impact, endpoint execution, internal expansion, cloud access, persistence, and downstream trust loss. Reliable strongSwan-specific attribution additionally requires version, plugin, PKCS#7, certificate, X.509, EAP, IKE SA, Child SA, CREATE_CHILD_SA, Multi-KE, rekey, peer-authentication, process, service-health, network, session, and forensic evidence.

CVE-2026-78135 requires the strongest pre-authentication session-boundary adaptation because the existing behavior family can represent unauthorized VPN access and downstream consequences, but direct identification of the initiating flaw requires proof that CREATE_CHILD_SA activity occurred on an unestablished IKE SA and produced a potentially usable Child SA before authentication completed.

CVE-2026-78134 requires identity-specific adaptation because existing detection behavior can represent unexplained authentication and downstream identity use but does not natively correlate strongSwan EAP-PEAP/EAP-TTLS outer and inner identities, authenticated credential identity, IKE identity, authorization state, uniqueness behavior, and virtual-IP assignment.

CVE-2026-78133 requires strongSwan-specific execution-path adaptation because the existing behavior model represents network-facing gateway execution risk but does not natively detect libcharon Multi-KE rekey-collision task state or associate an authenticated peer with the documented use-after-free.

The remaining strongSwan vulnerabilities primarily require product-specific service-health, certificate-processing, EAP, or parsing telemetry to distinguish malicious input from ordinary gateway instability. Their availability consequences fit the existing remote-access trust-loss behavior family.

Coverage With Adaptation is appropriate for CVE-2026-50751 because the existing behavior family represents remote-access gateway abuse, VPN-session and identity correlation, unexplained gateway-originated authentication, endpoint execution, internal expansion, cloud access, persistence, and ransomware-enabling access. Reliable exploit-path attribution additionally requires Check Point-specific Remote Access VPN or Mobile Access identification, IKEv1 configuration, legacy-client state, machine-certificate requirements, IKE and VPN-session telemetry, expected authentication evidence, source and user context, downstream access evidence, and forensic validation. Active exploitation, CISA KEV status, and the Qilin ransomware-affiliate connection increase urgency.

Qilin ransomware-affiliate activity remains Coverage With Adaptation because individual consequential procedures such as unauthorized VPN access, internal discovery, payload retrieval, identity use, endpoint access, lateral movement, and ransomware-stage activity can be detected, but reliable attribution requires corroborating Check Point exploitation evidence, payload or infrastructure evidence, endpoint and network findings, ransomware artifacts, victim-specific investigation findings, and attribution context. Check Point's medium-confidence actor assessment should not be represented as definitive Qilin attribution for every CVE-2026-50751 event.

Coverage With Adaptation remains appropriate for CVE-2026-20349 because the existing behavior family represents suspicious remote-access gateway activity, network-reachable service abuse, appliance-health changes, service disruption, and downstream effects, while reliable attribution requires Cisco ASA or FTD product and version context, vulnerable Remote Access SSL VPN configuration, HTTP-request evidence where available, unexpected reload or availability evidence, and incident-response validation. Cisco's active-exploitation statement and CISA KEV status increase urgency.

Coverage With Adaptation is appropriate for CVE-2026-20329 through CVE-2026-20336 because the existing behavior family can represent consequential gateway, management-plane, identity, policy, availability, and downstream trust effects, while reliable attribution requires Cisco Secure Firewall ASA, Secure FTD, or Secure FMC product and release context plus vulnerability-class-specific evidence. Cisco identifies all three product families as affected regardless of device configuration. The applicable first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. The applicable first fixed Secure FTD and Secure FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1. The eight hardening CVE groupings are not individually treated as known exploited. Cisco's active-exploitation statement for two underlying CWE-284 vulnerabilities is represented through the separately disclosed FMC CVE-2026-20079 and CVE-2026-20316 advisories.

Coverage With Adaptation is appropriate for CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, and CVE-2026-102258 because the existing remote-access-gateway behavior family can represent consequential appliance-local access, unauthorized execution, administrative abuse, identity use, internal expansion, and downstream trust effects, while reliable attribution requires SonicWall SMA1000 product and exact-version context plus Work Place or Appliance Management Console-specific request, authentication, administrative, archive or filesystem, application, process, network, appliance, and incident-response evidence according to the vulnerability. Affected releases include 12.4.3-03526 and earlier and 12.5.0-02952 and earlier, with correction in 12.4.3-03670 and 12.5.0-03082 or later. SonicWall states that there is currently no evidence that vulnerabilities addressed in the release are being exploited in the wild, and current authoritative evidence does not establish CISA KEV status for the four identifiers.

CVE-2026-83548 and CVE-2026-83549 are Direct Coverage because the existing behavioral model already implements the material defender-visible paths. CVE-2026-83548 maps to external proxy or relay behavior reaching appliance-local or otherwise prohibited services. CVE-2026-83549 maps to authenticated appliance administration and remote-code-execution behavior. Reliable local compromise determination still requires affected SMA1000 model and platform-hotfix validation together with gateway request, connection-result, administrative, configuration, process, network, identity, endpoint, and incident-response evidence. SonicWall's vendor-confirmed active-exploitation state and CISA's September 2, 2026 KEV additions increase urgency but do not establish local compromise and do not change the Direct Coverage classifications.

The seven OpenVPN 2.7.7 CVEs remain Coverage With Adaptation because the affected product, platform and service-mode distinctions, certificate and validation-script conditions, local binary-search-path behavior, service-object and IPC conditions, NRPT processing, DHCP option processing, configuration-path validation, and product-specific telemetry requirements are not natively represented by the current RRAS-, SonicWall-, WatchGuard-, Cisco-, Check Point-, or strongSwan-oriented S25 implementations. The affected scope reaches OpenVPN 2.6 releases through 2.6.22 and the 2.7 development line through 2.7.6, subject to CVE-specific lower-version boundaries and configuration qualifications. Successful exploitation or abuse can affect remote-access service availability, produce unauthorized command or configuration execution, manipulate network configuration, or create a downstream remote-access trust problem. Reliable CVE-specific assessment requires affected OpenVPN product, platform, version, service-mode, configuration, validation-script, certificate, path, file, process, command-line, service-control, IPC, tapctl, netsh.exe, NRPT, DHCP, tunnel, authentication, session, fault, network, and incident-response evidence as applicable. Remediation is OpenVPN 2.7.7 or the applicable maintained vendor or distribution security build. Current authoritative evidence does not establish that any of the seven are known exploited or CISA KEV-listed.

The WatchGuard Fireware CVE-2026-19318, CVE-2026-19315, and CVE-2026-19313 set remains Coverage With Adaptation because the affected product, IKE protocol path, iked daemon, memory-corruption mechanisms, service crash/respawn behavior, diagnostic-logging dependency for CVE-2026-19318, and appliance telemetry requirements are not natively represented by the current RRAS- and SonicWall-oriented S25 implementations. Successful exploitation can convert an internet-facing VPN gateway process into an unauthorized execution or service-impact pathway. Reliable CVE-specific assessment requires affected Fireware asset and version validation together with protocol, daemon-health, appliance, network, and incident-response evidence. WatchGuard states that it is not aware of exploitation of these vulnerabilities in the wild, and current authoritative evidence does not establish CISA KEV status for these three vulnerabilities.

CVE-2025-14733 is Coverage With Adaptation under the existing WatchGuard/IKE/iked remote-access-gateway behavior model because the affected product, IKEv2 configuration conditions, iked process, out-of-bounds-write mechanism, remote unauthenticated execution potential, historical stale-configuration condition, and appliance telemetry requirements are not natively represented by the generic S25 implementation. Successful exploitation can convert an internet-facing VPN gateway process into an unauthorized execution pathway and can enable identity pivoting, internal access, persistence, or ransomware-stage activity. Reliable CVE-specific assessment requires affected Fireware OS asset and version validation, current and historical IKEv2 configuration review, IKE protocol evidence, iked daemon-health and crash/respawn evidence, appliance telemetry, memory-corruption or execution evidence where available, downstream network and identity activity, and incident-response validation. CISA's known-ransomware-campaign-use designation increases remediation and retrospective-hunting urgency but does not establish attribution to a specific ransomware family.

Fire Ant remains Coverage With Adaptation because substantial portions of the documented compromise sequence can be detected, but complete coverage depends on additional Cisco IOS XR or equivalent router configuration and operational-state evidence, TACACS or equivalent authentication-server process and session visibility, Linux management-host process, file, persistence, network, and forensic telemetry, and independent evidence validation where router output, logging, authentication records, or host artifacts may have been manipulated. Fire Ant should not be treated as definitively equivalent to UNC3886 solely because Sygnia reports strong behavioral and contextual overlap.

RRAS Direct Coverage is strongest where confirmed host identity, external network activity, current RemoteAccess service-process attribution, process ancestry, and child-process creation can be joined by host and bounded time window. Coverage weakens when service-process attribution is missing or stale, service or host restart invalidates the process mapping, process ancestry is unavailable, memory-only exploitation produces no child process, or external activity cannot be correlated with execution.

Direct Coverage of the RRAS family does not extend automatically to local-only RRAS RCE or privilege-escalation vulnerabilities whose documented attack path does not satisfy the externally sourced network component implemented by S25.

The coverage model does not claim universal RRAS exploitation detection, universal Okta Access Gateway authorization-bypass detection, universal Check Point VPN authentication-bypass detection, universal Cisco Remote Access SSL VPN exploit detection, universal OpenVPN exploitation detection, universal strongSwan exploitation detection, universal CVE detection, universal SonicWall, WatchGuard, Cisco, Check Point, Okta, OpenVPN, or strongSwan compromise detection, universal VPN compromise detection, universal IKE exploit detection, universal security-management compromise detection, universal session-theft detection, universal credential-theft detection, malware-family or ransomware-affiliate identification, complete adversary coverage, universal KEV coverage, or standalone attribution.

RRAS detection confidence depends on confirmed RRAS asset identity, externally sourced network visibility, current RemoteAccess service-process attribution, process ancestry, process creation, local field mapping, bounded-time correlation, and the ability to distinguish exploit-associated execution from approved administration.

Okta CVE-2026-78626 assessment additionally depends on affected Access Gateway version validation, Protected Rule configuration, application-user and privilege context, request and authorization evidence, protected-resource mapping, downstream application access, and incident-response validation.

F5 CVE-2025-53521 and PoisonedRefresh assessment additionally depends on affected BIG-IP APM product and exact-version validation, APM access-policy state, F5 request and TMM evidence where available, Apache and PHP process context, /usr/sbin/httpd integrity, upgrade-image inspection, SELinux-state review, runtime-memory evidence involving libphp where available, UNIX-domain-socket and shell evidence, network activity, and incident-response validation. Clean on-disk copies of the three legitimate APM webtop PHP files do not independently exclude the documented in-memory web-shell mechanism.

Check Point CVE-2026-50751 assessment additionally depends on affected Security Gateway and version validation, Remote Access VPN or Mobile Access configuration, IKEv1 use, legacy-client acceptance, machine-certificate requirements, IKE and VPN-session evidence, authentication and identity context, source and destination attribution, downstream activity, hotfix and configuration history, and incident-response validation.

Cisco CVE-2026-20349 assessment additionally depends on affected ASA or FTD validation, Remote Access SSL VPN or applicable listening configuration, request and network evidence, device-health and reload records, availability evidence, and incident-response validation.

OpenVPN assessment additionally depends on product, platform, package, version, service-mode, configuration, certificate, validation-script, path, file, process, command-line, service-control, IPC, NRPT, DHCP, tunnel, fault, authentication, session, and network evidence as applicable.

strongSwan assessment additionally depends on product, package, version, IKEv1/IKEv2 state, loaded plugins, PKCS#7 and certificate-processing context, X.509 attribute-certificate handling, EAP-AKA/EAP-PEAP/EAP-TTLS configuration where applicable, IKE/EAP identity mapping, authenticated-peer context, IKE SA and Child SA state, CREATE_CHILD_SA activity, Multi-KE and rekey state, daemon-health, process and memory behavior, network evidence, authentication and session telemetry, and incident-response validation.

SonicWall CVE-2026-83548 and CVE-2026-83549 assessment additionally depends on SMA1000 model and platform-hotfix validation, requested-destination and connection-result visibility, appliance-administration and configuration evidence, process or command-execution evidence where available, and incident-response validation.

WatchGuard assessment additionally depends on Fireware asset and version validation, IKE visibility, iked daemon-health evidence, appliance telemetry, diagnostic-logging configuration where applicable, and incident-response validation. CVE-2025-14733 assessment additionally depends on applicable current and historical IKEv2 configuration, including the documented stale-configuration condition where relevant, together with evidence sufficient to distinguish vulnerable-state or operational daemon behavior from successful exploitation and downstream activity.

Broader detection confidence depends on telemetry completeness, field mapping, requested-destination visibility, connection-result fidelity, gateway and management-asset mapping, administrative-event quality, VPN-session fidelity, SmartConsole and application-token visibility, Trusted Client configuration history, security-policy and policy-installation records, change-control accuracy, identity normalization, workstation attribution, endpoint visibility, cloud correlation, approved exceptions, query validation, retention, performance testing, false-positive testing, and SOC triage readiness.

Executive Exposure Statement

The organization's economic exposure is highest when suspicious gateway, RRAS, VPN, or security-management activity creates uncertainty around whether remote-access, Windows service, appliance, VPN daemon, IKE SA, Child SA, EAP identity, management-plane, security-policy, session, credential, identity, endpoint, internal-network, and cloud trust remained intact. The strategic risk is not only that a specific RRAS, SonicWall, WatchGuard, Check Point, Cisco, OpenVPN, strongSwan, or other remote-access vulnerability exists, active exploitation has been confirmed elsewhere, a KEV designation exists, public technical details are available, a remediation deadline has been established, or a gateway, RRAS server, VPN gateway, or management server remains unpatched.

The material risk is that an adversary may have achieved suspicious service-context execution, established unauthorized VPN access, created a usable Child SA before authentication, crossed an identity or authorization boundary, exploited a network-facing gateway daemon or remote-access service, reached appliance-local services, obtained administrative access, altered security policies or configurations, executed commands, exposed authentication material, reused trusted identities, reached internal systems, affected cloud resources, established persistence, enabled ransomware-stage activity, weakened enforcement controls, or undermined confidence in remote-access and security-management infrastructure before containment.

S40 — References

Vendor and Platform Security Advisories

·        BeyondTrust — BT26-05 — Improper Origin Validation in an Internal Messaging Component — CVE-2026-102764 — October 15, 2026 — supporting the critical unauthenticated Remote Support appliance file-operations vulnerability, CVSS v4.0 score of 9.3, affected versions through 26.2.3, BT26-05-RS remediation requirements, October 9 SaaS patch deployment, and vulnerability-specific exposure conditions represented in S39 — hxxps://www[.]beyondtrust[.]com/trust-center/security-advisories/bt26-05

·        BeyondTrust — ARMORY CASTLE and BT26-05: What Security Teams Need to Know — October 15, 2026 — supporting the confirmed zero-day exploitation of CVE-2026-102764 against BeyondTrust Remote Support, coordinated vulnerability disclosure, precautionary Privileged Remote Access patching guidance, and remediation and compromise-assessment recommendations represented in S39 — hxxps://www[.]beyondtrust[.]com/blog/entry/bt26-05

·        Ivanti — Security Advisory: Ivanti Connect Secure CVE-2026-104935 — October 13, 2026 — supporting the authentication-bypass-by-spoofing vulnerability permitting unauthenticated remote command execution, affected and corrected Connect Secure release boundaries, vendor-confirmed limited exploitation in the wild, and remediation and compromise-assessment guidance represented in S39 — hxxps://hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

·        Citrix / Cloud Software Group — Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406 — CTX697191 — October 8, 2026 — supporting the memory-overflow vulnerability capable of remote code execution or denial of service, version-dependent SAML SP or SAML IdP configuration prerequisites, affected and fixed release boundaries, and remediation guidance represented in S39 — hxxps://support[.]citrix[.]com/external/article/CTX697191

·        Citrix / Cloud Software Group — Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779 — CTX697174 — October 3, 2026 — supporting the memory-overflow denial-of-service condition, SAML SP or SAML IdP prerequisite, affected and fixed version boundaries, and remediation guidance represented in S39 — hxxps://support[.]citrix[.]com/external/article/CTX697174

·        Citrix / Cloud Software Group — Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 — CTX697096 — September 27, 2026 — supporting the eight NetScaler vulnerability identities, affected configuration conditions, affected and fixed version boundaries, vendor-confirmed exploitation of CVE-2026-88771 and CVE-2026-88772, and the Enhanced ISN Generation mitigation applicable to CVE-2026-88778 represented in S39 — hxxps://support[.]citrix[.]com/external/article/CTX697096

·        F5 — K000162605 — BIG-IP APM Vulnerability — CVE-2026-94127 — September 22, 2026 — supporting the APM access-policy plus OAuth-profile prerequisite, unauthenticated heap-based-buffer-overflow remote code execution, affected and fixed engineering-hotfix boundaries, Appliance-mode applicability, data-plane scope, and vendor-confirmed exploitation state represented in S39 — hxxps://my[.]f5[.]com/manage/s/article/K000162605

·        Check Point — Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616 — September 22, 2026 — supporting the updated active-exploitation state for CVE-2026-85102, observed exploitation attempts against Spark customers beginning September 12, anonymization-infrastructure context, and immediate remediation and hunting guidance — hxxps://blog[.]checkpoint[.]com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

·        Check Point — ASN.1 Decoding Heap Overflow Leading to Remote Code Execution — CVE-2026-85103 — September 9, 2026 — hxxps://support[.]checkpoint[.]com/results/sk/sk1000118

·        Check Point — Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN — CVE-2026-85102 — September 9, 2026 — hxxps://support[.]checkpoint[.]com/results/sk/sk1000117

·        Okta — Improper Input Sanitization in Okta Access Gateway Protected Rules, CVE-2026-78626 — September 2026 — hxxps://trust[.]okta[.]com/security-advisories/improper-input-sanitization-in-okta-access-gateway-protected-rules-cve-2026-78626

·        strongSwan — strongSwan 6.1.0 Released — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-6[.]1[.]0-released[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78123 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78123%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78124 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78124%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78126 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78126%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78127 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78127%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78129 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78129%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78130 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78130%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78131 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78131%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78132 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78132%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78133 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78133%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78134 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78134%29[.]html

·        strongSwan — strongSwan Vulnerability CVE-2026-78135 — September 7, 2026 — hxxps://www[.]strongswan[.]org/blog/2026/09/07/strongswan-vulnerability-%28cve-2026-78135%29[.]html

·        SonicWall — Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities (SNWLID-2026-0017) — October 6, 2026 — supporting CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, and CVE-2026-102258, affected and corrected SMA1000 version boundaries, and remediation guidance represented in S39 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2026-0017

·        SonicWall — Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities (SNWLID-2026-0016) — September 1, 2026 — hxxps://www[.]sonicwall[.]com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016/kA1VN000002AXmQ0AW

·        WatchGuard — Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service — CVE-2026-86134 — September 30, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86134/

·        WatchGuard — Fireware OS Resource Exhaustion in Login Process Allows Denial of Service — CVE-2026-86104 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86104/

·        WatchGuard — Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution — CVE-2026-18145 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-18145/

·        WatchGuard — Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution — CVE-2026-13046 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-13046/

·        WatchGuard — Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access — CVE-2026-86101 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86101/

·        WatchGuard — Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service — CVE-2026-86133 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86133/

·        WatchGuard — Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read — CVE-2026-13224 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-13224/

·        WatchGuard — Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service — CVE-2026-86132 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86132/

·        WatchGuard — Fireware OS Improper Authorization in Access Portal Reverse Proxy — CVE-2026-86105 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86105/

·        WatchGuard — Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B — CVE-2026-90441 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-90441/

·        WatchGuard — Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution — CVE-2026-86131 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86131/

·        WatchGuard — Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A — CVE-2026-86136 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86136/

·        WatchGuard — Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution — CVE-2026-81433 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-81433/

·        WatchGuard — Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service — CVE-2026-86128 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-86128/

·        WatchGuard — Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service — CVE-2026-18105 — September 29, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-18105/

·        WatchGuard — Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution, CVE-2026-19318 — August 27, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-19318

·        WatchGuard — Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution, CVE-2026-19315 — August 27, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-19315

·        WatchGuard — Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution, CVE-2026-19313 — August 27, 2026 — hxxps://psirt[.]watchguard[.]com/CVE-2026-19313

·        WatchGuard — Immediate Action Required - Update Your Firebox Now — August 27, 2026 — hxxps://www[.]watchguard[.]com/wgrd-blog/immediate-action-required-update-your-firebox-now

·        Check Point — Security Advisory - Action Required - Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751) — June 2026 — hxxps://blog[.]checkpoint[.]com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/

·        F5 — K000156741 — BIG-IP APM Vulnerability, CVE-2025-53521 — updated March 27, 2026 — hxxps://my[.]f5[.]com/manage/s/article/K000156741

·        WatchGuard — Firebox iked Out of Bounds Write Vulnerability — CVE-2025-14733 — December 19, 2025 — hxxps://psirt[.]watchguard[.]com/CVE-2025-14733/

·        Check Point — SK185033 — Remote Access / Mobile Access Hotfix and Mitigation Guidance for CVE-2026-50751 — hxxps://support[.]checkpoint[.]com/results/sk/sk185033

·        Check Point — SK185035 — Related IKEv1 Certificate-Validation Security Guidance — hxxps://support[.]checkpoint[.]com/results/sk/sk185035

·        OpenVPN — v2.7.7 — hxxps://github[.]com/OpenVPN/openvpn/releases/tag/v2.7.7

·        Microsoft — Microsoft Security Update Guide, Windows Routing and Remote Access Service vulnerability records — hxxps://msrc[.]microsoft[.]com/update-guide/

·        Cisco — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability, CVE-2026-20349 — hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF

·        Cisco — Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026 — CVE-2026-20329, CVE-2026-20330, CVE-2026-20331, CVE-2026-20332, CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, and CVE-2026-20336 — September 16, 2026 — hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN

·        Check Point — SmartConsole Improper Authentication Vulnerability, CVE-2026-16232 — hxxps://support[.]checkpoint[.]com/results/sk/sk185169

·        SonicWall — SonicWall SMA1000 Series Appliances Affected by Multiple Vulnerabilities, CVE-2026-15409 and CVE-2026-15410 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2026-0008

·        SonicWall — SonicWall SMA1000 Encoded URL SSRF Vulnerability, CVE-2025-40595 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2025-0010

·        SonicWall — SonicWall SMA1000 SSRF Vulnerability, CVE-2025-2170 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2025-0008

·        SonicWall — SMA1000 Pre-Authentication Remote Command Execution Vulnerability, CVE-2025-23006 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2025-0002

·        SonicWall — SonicWall SMA100 SSL-VPN Affected by Multiple Vulnerabilities, CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2025-0011

·        SonicWall — SonicWall SMA100 SSL-VPN Affected by Multiple Vulnerabilities, Including CVE-2024-38475 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2024-0018

·        SonicWall — SonicOS Improper Access Control Vulnerability, CVE-2024-40766 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2024-0015

·        SonicWall — SonicWall SMA100 SSL-VPN Affected by Multiple Vulnerabilities, CVE-2023-44221 and CVE-2023-5970 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2023-0018

·        SonicWall — Authenticated SMA100 Arbitrary Command Injection Vulnerability, CVE-2021-20035 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2021-0022

·        SonicWall — Confirmed Zero-Day Vulnerability in the SonicWall SMA100 Build Version 10.x, CVE-2021-20016 — hxxps://psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2021-0001

CVE Records

·        CVE Program — CVE-2026-102764 — BeyondTrust Remote Support Improper Origin Validation in an Internal Messaging Component — October 15, 2026 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-102764

·        CVE Program — CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing — October 13, 2026 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-104935

·        CVE Program — CVE-2026-107406 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-107406

·        CVE Program — CVE-2026-102258 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-102258

·        CVE Program — CVE-2026-102257 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-102257

·        CVE Program — CVE-2026-102256 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-102256

·        CVE Program — CVE-2026-102255 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-102255

·        CVE Program — CVE-2026-88779 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-88779

·        CVE Program — CVE-2026-94127 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-94127

·        CVE Program — CVE-2026-85103 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-85103

·        CVE Program — CVE-2026-85102 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-85102

·        CVE Program — CVE-2026-78626 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78626

·        CVE Program — CVE-2025-53521 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2025-53521

·        CVE Program — CVE-2025-14733 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2025-14733

·        CVE Program — CVE-2026-78135 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78135

·        CVE Program — CVE-2026-78134 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78134

·        CVE Program — CVE-2026-78133 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78133

·        CVE Program — CVE-2026-78132 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78132

·        CVE Program — CVE-2026-78131 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78131

·        CVE Program — CVE-2026-78130 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78130

·        CVE Program — CVE-2026-78129 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78129

·        CVE Program — CVE-2026-78127 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78127

·        CVE Program — CVE-2026-78126 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78126

·        CVE Program — CVE-2026-78124 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78124

·        CVE Program — CVE-2026-78123 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78123

·        CVE Program — CVE-2026-50751 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-50751

·        CVE Program — CVE-2026-20349 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-20349

·        CVE Program — CVE-2026-84732 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-84732

·        CVE Program — CVE-2026-84256 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-84256

·        CVE Program — CVE-2026-84226 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-84226

·        CVE Program — CVE-2026-82312 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-82312

·        CVE Program — CVE-2026-78221 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78221

·        CVE Program — CVE-2026-78043 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-78043

·        CVE Program — CVE-2026-81738 — hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-81738

Government Vulnerability and Exploitation Records

·        FBI / U.S. Secret Service — Joint Cybersecurity Advisory JCSA-20261006-01 — FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts — October 6, 2026 — supporting confirmed active global credential-compromise activity targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, credential stuffing and password spraying, compromised credential reuse, credential and password-hash harvesting, unauthorized administrative-account creation, legitimate-administrator lockouts, persistence, internal discovery, lateral movement, and ransomware-affiliate access enablement represented in S39 — hxxps://www[.]fbi[.]gov/investigate/cyber/alerts/2026/fortibleed-operations-continue-targeting-exposed-systems-leading-to-reports-of-lockouts

·        CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog — 16 October 2026 — CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability; CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability — hxxps://www[.]cisa[.]gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-104935 — Added October 13, 2026 — confirming active exploitation of Ivanti Connect Secure authentication bypass by spoofing, unauthenticated remote command execution risk, October 16, 2026 remediation deadline, and applicable forensic-triage requirements — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935

·        CERT-FR — CERTFR-2026-AVI-1275 — Multiples vulnérabilités dans Sonicwall Secure Mobile Access — October 7, 2026 — supporting the SNWLID-2026-0017 four-CVE cohort, remote-code-execution-related, server-side-request-forgery, and cross-site-scripting risk, affected SMA1000 boundaries, and corrected releases 12.4.3-03670 and 12.5.0-03082 — hxxps://www[.]cert[.]ssi[.]gouv[.]fr/avis/CERTFR-2026-AVI-1275/

·        CISA — Known Exploited Vulnerabilities Catalog — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-88779 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779

·        CISA — CISA Adds One Known Exploited Vulnerability to Catalog — October 4, 2026 — supporting the CISA KEV addition and active-exploitation state for CVE-2026-88779

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-88771 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-88772 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772

·        CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog — September 27, 2026 — supporting the CISA KEV additions and active-exploitation state for CVE-2026-88771 and CVE-2026-88772 — hxxps://www[.]cisa[.]gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-94127 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-85102 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2025-14733 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2025-53521 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-50751 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751

·        CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-20349 filtered record — hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349

·        CISA — CISA Adds Seven Known Exploited Vulnerabilities to Catalog — September 2, 2026 — includes CVE-2026-83548 and CVE-2026-83549 / SonicWall SMA1000 — hxxps://www[.]cisa[.]gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog

·        National Institute of Standards and Technology — National Vulnerability Database — hxxps://nvd[.]nist[.]gov/

Threat Technique Framework

·        MITRE ATT&CK — hxxps://attack[.]mitre[.]org/

Original Security Research and Threat Analysis

·        Google Threat Intelligence Group / Mandiant — ARMORY CASTLE Exploits BeyondTrust — October 15, 2026 — supporting confirmed zero-day exploitation of BeyondTrust Remote Support CVE-2026-102764 beginning in late August 2026, attribution to suspected PRC-nexus espionage actor ARMORY CASTLE formerly tracked as UNC5221, deployment of the SAWFLY PHP webshell and BARECLAW SOCKS5-over-WebSocket tunneler, SUID-based privilege escalation, credential-vault access attempts, persistent administrative access, HAProxy configuration manipulation, log deletion, remote-support session abuse, lateral movement, and published artifact-based YARA detection signatures — hxxps://cloud[.]google[.]com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust

·        BleepingComputer — Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit — September 8, 2026 — hxxps://www[.]bleepingcomputer[.]com/news/security/hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit/

·        Sophos X-Ops / SophosLabs — Dissecting a PHP web server rootkit — September 7, 2026 — hxxps://news[.]sophos[.]com/en-us/2026/09/07/dissecting-a-php-web-server-rootkit/

·        SecurityWeek — WatchGuard Patches Critical Vulnerabilities — September 1, 2026 — hxxps://www[.]securityweek[.]com/watchguard-patches-critical-vulnerabilities/

·        BleepingComputer — Check Point Links VPN Zero-Day Attacks to Qilin Ransomware Gang — June 8, 2026 — hxxps://www[.]bleepingcomputer[.]com/news/security/check-point-links-vpn-zero-day-attacks-to-qilin-ransomware-gang/

·        Rapid7 — Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751) — June 2026 — hxxps://www[.]rapid7[.]com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751/

·        Sygnia — Fire Ant Evolves: From Hypervisors to Trusted Infrastructure — hxxps://www[.]sygnia[.]co/blog/fire-ant-evolves-from-hypervisors-to-trusted-infrastructure/

·        Sygnia — Sygnia Reveals New Activity by China-Nexus Threat Actor Fire Ant Targeting Trusted Infrastructure — hxxps://www[.]sygnia[.]co/press-release/sygnia-reveals-new-activity-by-china-nexus-threat-actor-fire-ant-targeting-trusted-infrastructure/

·        Rapid7 — Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero-Days Being Actively Exploited, CVE-2026-15409 and CVE-2026-15410 — hxxps://www[.]rapid7[.]com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/

·        Rapid7 — Multiple Vulnerabilities in SonicWall SMA100 Series, CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821 — hxxps://www[.]rapid7[.]com/blog/post/2025/05/07/multiple-vulnerabilities-in-sonicwall-sma100-series-2025/

·        Google Threat Intelligence Group — Ongoing SonicWall Secure Mobile Access Exploitation Campaign Using the OVERSTEP Backdoor — hxxps://cloud[.]google[.]com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor

·        Rapid7 — Akira Ransomware Group Utilizing SonicWall Devices for Initial Access — hxxps://www[.]rapid7[.]com/blog/post/dr-akira-ransomware-group-utilizing-sonicwall-devices-for-initial-access/

·        SecurityWeek — Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks — hxxps://www[.]securityweek[.]com/recent-sonicwall-vulnerabilities-exploited-in-ransomware-attacks/

Reference Usage Note

The October 6, 2026 FBI and U.S. Secret Service Joint Cybersecurity Advisory JCSA-20261006-01 supports the Coverage With Adaptation classification for the FortiBleed campaign/procedure set. The agencies identify FortiBleed as an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Documented activity includes reconnaissance of exposed devices, credential stuffing and password spraying using previously compromised credentials, collection of authentication information and password hashes, unauthorized administrative-account creation, modification or deletion of legitimate accounts, administrator lockouts, persistence, internal reconnaissance, lateral-access attempts, and downstream ransomware-enablement activity. The campaign represents credential-based compromise and access abuse rather than a newly identified Fortinet CVE, and its inclusion does not change the existing CVE register or CISA KEV accounting. FortiBleed remains Coverage With Adaptation because reliable campaign-specific identification and compromise assessment require FortiGate product and configuration validation, internet-exposure history, administrative and SSL VPN authentication records, failed-to-success authentication sequences, account creation and modification events, session and token activity, configuration-integrity evidence, firewall and network-flow telemetry, internal authentication and discovery activity, credential-use correlation, and incident-response findings. Existing S25 behavioral detection families address suspicious gateway authentication, unauthorized administrative activity, credential misuse, gateway-originated internal access, lateral movement, and downstream enterprise compromise when the required telemetry is available. However, these behavioral detections do not independently establish FortiBleed attribution or compromise of a particular FortiGate deployment. The campaign's confirmed activity warrants credential and session containment, administrative-account review, management-plane hardening, and retrospective compromise assessment without requiring a new generic S25 detection rule, S13 expansion, S21–S25 modification, or S26 change.

The BeyondTrust BT26-05 security advisory, BeyondTrust October 15, 2026 incident-response guidance, CVE-2026-102764 record, and Google Threat Intelligence Group / Mandiant technical research support the Coverage With Adaptation classification for CVE-2026-102764 and the associated ARMORY CASTLE procedure set. BeyondTrust identifies a critical improper-origin-validation vulnerability affecting internal Remote Support messaging components that can permit an unauthenticated remote attacker to perform unauthorized appliance file operations. Affected Remote Support versions include all releases through 26.2.3. BeyondTrust confirms remediation through the BT26-05-RS patch for supported self-hosted versions 24.3.1 through 26.2.3 and reports that Remote Support SaaS deployments received the corrective patch on October 9, 2026. Earlier self-hosted releases require an upgrade before the applicable patch can be installed. BeyondTrust additionally recommends precautionary patching of Privileged Remote Access because the product shares affected code, while explicitly stating that its internal testing has not identified an exploitable Privileged Remote Access path. Mandiant documents confirmed zero-day exploitation beginning in late August 2026 and attributes the observed intrusion to ARMORY CASTLE, formerly UNC5221, a suspected PRC-nexus espionage actor. Observed post-exploitation activity includes deployment of the SAWFLY PHP webshell, execution of the BARECLAW SOCKS5-over-WebSocket tunneler, SUID-enabled root privilege escalation, attempted access to BeyondTrust credential-vault contents, persistence through startup scripts and sudoers configuration templates, malicious HAProxy routing changes, administrative permission manipulation, remote-support session abuse, internal reconnaissance, file transfers, and anti-forensic log deletion. These behaviors materially expand the applicable appliance-compromise, credential-access, persistence, tunneling, identity-pivoting, and downstream enterprise-exposure context without independently establishing a missing generic behavioral S25 detection family. Reliable vulnerability-specific identification and compromise assessment require affected-product and exact-version validation, appliance exposure history, internal messaging and file-operation evidence where available, web and reverse-proxy logs, appliance process and filesystem telemetry, privileged-execution and configuration-integrity evidence, credential-vault access records, support-session and administrative audit activity, outbound and internal network telemetry, and incident-response findings. The published Google YARA signatures for SAWFLY and BARECLAW provide artifact-based identification opportunities requiring accessible files, memory, or forensic collections; they are not behavioral detections and do not independently prove execution, exploitation, persistence, or successful compromise. Confirmed campaign exploitation increases remediation and retrospective-investigation urgency but does not establish compromise of every vulnerable BeyondTrust deployment. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities Catalog on October 16, 2026, establishing KEV-confirmed status for the BeyondTrust Remote Support vulnerability. This designation reinforces remediation and retrospective-investigation priority without changing the existing Coverage With Adaptation classification. Current evidence supports Coverage With Adaptation without requiring changes to the existing S13, S21–S25 detection framework.

The Ivanti Connect Secure security advisory, CVE Program record, and October 13, 2026 CISA Known Exploited Vulnerabilities Catalog entry support the Coverage With Adaptation classification for CVE-2026-104935. Ivanti identifies an authentication-bypass-by-spoofing vulnerability that permits unauthenticated remote attackers to execute arbitrary commands against affected Connect Secure appliances. The vendor-confirmed affected releases include Ivanti Connect Secure 22.8R2.4 and earlier within the 22.8 branch, 25.1.2.2 and earlier within the applicable 25.1.2 branch, and 25.1.1.1 and earlier within the applicable 25.1.1 branch, subject to product-specific and release-specific prerequisites; Ivanti explicitly identifies the 22.7 branch, including 22.7R2.14 and earlier, as unaffected by this vulnerability. The CNA identifies 22.7R2.14, 22.8R2.5, 25.1.3.0, and 25.1.3.1 as unaffected releases. Ivanti confirms limited exploitation in the wild at disclosure, and CISA added the vulnerability to KEV on October 13, 2026, with an October 16, 2026 remediation deadline and applicable forensic-triage requirements. Reliable vulnerability-specific identification requires Ivanti product and exact-version validation, authentication and request evidence, appliance process and command-execution telemetry, configuration and filesystem activity, outbound network behavior, downstream authentication and identity activity, and incident-response findings beyond the existing generic S25 gateway detection families. Existing behavioral coverage can identify consequential appliance compromise and identity pivoting when observable but does not independently identify the initiating Ivanti vulnerability. Vulnerable-version state, internet exposure, KEV designation, remediation activity, or isolated authentication anomalies do not independently establish successful exploitation of a specific deployment.

The Citrix CTX697191 advisory and CVE-2026-107406 record support the NetScaler Coverage With Adaptation entry. Citrix identifies CVE-2026-107406 as a critical memory-overflow vulnerability capable of remote code execution or denial of service in affected NetScaler ADC and NetScaler Gateway deployments. Exploitation requires a vulnerable appliance configured as a SAML service provider or SAML identity provider, subject to release-specific prerequisites. NetScaler ADC and NetScaler Gateway 14.1 builds 73.37 through 73.41 and 13.1 builds 64.23 through 64.28, including corresponding affected FIPS and NDcPP build ranges, require SAML IdP configuration for the documented exposure. Earlier affected builds may be vulnerable when configured as either a SAML SP or SAML IdP. Corrected releases include NetScaler ADC and Gateway 14.1-73.46, 13.1-64.29, NetScaler ADC FIPS 14.1-73.46, and NetScaler ADC FIPS/NDcPP 13.1-37.283 or later.

CVE-2026-107406 remains Coverage With Adaptation because reliable vulnerability-specific identification and compromise assessment require affected-product and exact-version validation, SAML SP or SAML IdP configuration state, relevant inbound SAML and authentication activity, appliance process and execution evidence, memory and service-health telemetry, crash or restart activity, outbound network behavior, downstream access, and incident-response findings. The vulnerability introduces remote-code-execution potential beyond the denial-of-service consequence documented for CVE-2026-88779 but does not require a new generic S25 detection family. Current authoritative evidence reviewed for this amendment does not establish confirmed exploitation in the wild or CISA Known Exploited Vulnerabilities Catalog status for CVE-2026-107406. Vulnerable-version state, SAML configuration, service instability, or remediation alone does not establish successful exploitation or compromise of a specific NetScaler deployment.

The Citrix CTX697174 advisory and the CVE-2026-88779 record support the new NetScaler Coverage With Adaptation entry. Citrix identifies CVE-2026-88779 as a memory overflow leading to denial of service when NetScaler ADC or NetScaler Gateway is configured as a SAML SP or SAML IdP. Affected supported releases are NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, NetScaler ADC FIPS 14.1 before 14.1-73.41 FIPS, and NetScaler ADC FIPS / NDcPP 13.1 before 13.1-37.282. CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities Catalog on October 4, 2026, based on evidence of active exploitation. The KEV addition increases remediation and investigation urgency but does not independently establish successful exploitation of a specific local NetScaler deployment. Local assessment requires affected-product and exact-version validation, SAML SP or SAML IdP configuration state, relevant SAML and authentication activity, gateway service-health and crash or restart evidence, appliance and network telemetry, and incident-response findings.

The Check Point September 9, 2026 security advisory notice, the September 22, 2026 active-exploitation advisory, and Check Point CNA CVE records support CVE-2026-85102 and CVE-2026-85103. Check Point identifies both as critical VPN-related vulnerabilities that could potentially permit unauthenticated remote code execution under specific conditions. Both were discovered internally. Check Point's September 22 update now confirms exploitation attempts against Spark customers globally for CVE-2026-85102 beginning September 12, 2026. The company continues to report no indication of active exploitation for CVE-2026-85103.

CVE-2026-85102 is titled Improper Certificate Validation in Quantum Security Gateway in the Check Point CNA record. Check Point describes improper certificate trust validation during VPN negotiation that may allow an unauthenticated remote attacker to execute arbitrary code on the Quantum Security Gateway. The corresponding Check Point security advisory is Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN, sk1000117. Affected versions are R82.10 with Jumbo Hotfix Take 43 or below, R82 with Jumbo Hotfix Take 125 or below, and R81.20 with Jumbo Hotfix Take 165 or below. The CNA record assigns CVSS 9.8.

CVE-2026-85103 is titled Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding in the Check Point CNA record. Check Point describes a heap-based buffer overflow in VPN certificate ASN.1 decoding that may allow an unauthenticated remote attacker to execute arbitrary code on Quantum Security Gateway and Quantum Security Management systems. The corresponding Check Point security advisory is ASN.1 Decoding Heap Overflow Leading to Remote Code Execution, sk1000118. The same affected Jumbo Hotfix boundaries apply: R82.10 with Jumbo Hotfix Take 43 or below, R82 with Jumbo Hotfix Take 125 or below, and R81.20 with Jumbo Hotfix Take 165 or below. The CNA record assigns CVSS 9.8.

Check Point states that customers using Check Point Live Patch will be automatically protected as rollout begins on September 9, 2026 and recommends installing the latest applicable Jumbo Hotfix. These remediation measures reduce future exploitability but do not independently establish whether activity occurred before remediation. Local assessment requires affected-product and version validation, VPN exposure and certificate-processing context, network and session telemetry, process, crash, memory-corruption or execution evidence where available, management activity for CVE-2026-85103 where applicable, and incident-response findings.

CVE-2026-85102 and CVE-2026-85103 are classified as Coverage With Adaptation. Check Point confirms active exploitation attempts for CVE-2026-85102, and CISA added CVE-2026-85102 to the Known Exploited Vulnerabilities Catalog on September 22, 2026. Current authoritative evidence continues to show no confirmed exploitation or CISA KEV status for CVE-2026-85103.

The Okta security advisory supports CVE-2026-78626. Okta identifies the issue as improper input sanitization affecting the Protected Rule authorization check in Okta Access Gateway. The vulnerable condition applies when a Protected Rule is configured on an application resource and can allow an authenticated low-privilege application user to bypass authorization.

Affected Okta Access Gateway versions are those before 2026.9.1. CVE-2026-78626 is classified as Coverage With Adaptation.

Okta reports no known exploitation. Current authoritative evidence does not establish CISA KEV status for CVE-2026-78626. The absence of known exploitation or KEV status does not independently establish that a vulnerable local deployment was not abused. Local assessment requires affected-version validation, Protected Rule configuration, authenticated application-user and privilege context, request and authorization evidence, protected-resource mapping, downstream application access, and incident-response findings.

The F5 K000162605 advisory and the CVE-2026-94127 record support the new BIG-IP APM Coverage With Adaptation entry. F5 identifies a heap-based buffer overflow that is reachable when an APM access policy and an OAuth profile are configured on the same virtual server. Specific malicious traffic can permit an unauthenticated attacker to execute arbitrary code. F5 states that Appliance mode is also vulnerable and that the issue is a data-plane vulnerability with no control-plane exposure.

Affected supported branches are BIG-IP 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, 17.5.x before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and 17.1.x before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. F5 confirms exploitation in the wild, and CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities Catalog on September 22, 2026. The CVE remains Coverage With Adaptation because reliable attribution requires F5-specific virtual-server, APM-policy, OAuth-profile, request, runtime, process, memory, service, network, appliance, and incident-response context.

The F5 K000156741 advisory supports CVE-2025-53521. F5 identifies the affected BIG-IP APM condition as unauthenticated remote code execution when an APM access policy is configured on a virtual server and specific malicious traffic reaches an affected version. F5 reclassified the issue from its earlier denial-of-service understanding on March 27, 2026 and confirmed exploitation. The applicable fixed release boundaries include 17.5.1.3, 17.1.3, 16.1.6.1, and 15.1.10.8 according to branch.

CISA's CVE-2025-53521 KEV record establishes the March 27, 2026 Known Exploited Vulnerabilities Catalog addition. The CVE is classified as Coverage With Adaptation.

The Sophos X-Ops / SophosLabs September 7, 2026 analysis supports the PoisonedRefresh / F5 c05d5254 procedure-set coverage. Sophos describes a second-stage Linux implant associated with compromised BIG-IP APM environments that infects or relies on a modified Apache httpd path, executes before normal application logic, hooks Apache Portable Runtime module loading, waits for libphp, alters PHP file and memory handling at runtime, and injects a PHP web shell into the in-memory representation of legitimate BIG-IP APM webtop scripts without requiring the final malicious PHP content to exist on disk. The analysis also identifies a local UNIX-domain-socket access path capable of redirecting a connection to /bin/bash.

PoisonedRefresh is treated as Coverage With Adaptation because the documented procedure set requires F5-specific runtime, memory, process, filesystem, upgrade-image, network, and forensic evidence.

The F5 and Sophos sources materially change compromise-assessment and detection-evasion context because disk-only web-shell searches, clean hashes of the legitimate APM PHP files, or patch deployment alone cannot exclude the documented memory-only execution and persistence path. Local conclusions require F5-specific product and version context plus relevant runtime-memory, process, filesystem, upgrade-image, service, network, and incident-response evidence.

The strongSwan 6.1.0 release announcement states that strongSwan 6.1.0 fixes eleven vulnerabilities: CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134, and CVE-2026-78135. The release is the upstream remediation boundary for the set.

The eleven strongSwan CVEs are classified as Coverage With Adaptation. Current authoritative evidence establishes the vulnerabilities and the 6.1.0 correction boundary but does not establish confirmed in-the-wild exploitation or CISA KEV status for the eleven identifiers.

The strongSwan individual advisories establish the CVE-specific affected-version boundaries and technical conditions. The affected lower bounds are CVE-2026-78123 and CVE-2026-78124 from 5.0.2; CVE-2026-78126 from 4.1.10; CVE-2026-78127 from 4.1.2; CVE-2026-78129 from 4.6.2; CVE-2026-78130 and CVE-2026-78131 from 4.2.0; CVE-2026-78132 from 5.1.3; CVE-2026-78133 from 6.0.0; CVE-2026-78134 from 4.5.0; and CVE-2026-78135 from 5.9.7.

CVE-2026-78123 is an OpenSSL-plugin PKCS#7 processing flaw capable of producing undefined memory access and a crash. It remains Coverage With Adaptation because product-, plugin-, PKCS#7-, certificate-, daemon-health-, and network-specific evidence is required for reliable identification.

CVE-2026-78124 is an OpenSSL-plugin PKCS#7 certificate-enumeration memory leak. The principal documented remote attack path uses IKEv1 PKCS#7 certificate processing, and configurations that do not accept IKEv1 or do not use the OpenSSL plugin may not expose that path. The vendor does not identify remote code execution as a consequence of this issue.

CVE-2026-78126 is an eap-aka plugin null-pointer condition triggered through unexpected AKA-Synchronization-Failure processing. It remains Coverage With Adaptation because reliable attribution requires EAP-AKA configuration, authentication-session, message, daemon-health, network, and incident-response context.

CVE-2026-78127 is a libcharon IKE-message stringification memory leak that can lead to denial of service through memory exhaustion. Reliable assessment requires affected-version, IKE-message, logging, memory-utilization, service-health, and network correlation.

CVE-2026-78129 affects encrypted PKCS#7 processing in libstrongswan. The vendor documents unbounded cryptographic-processing parameters capable of blocking a processing thread or causing a crash. The principal documented remote path can involve encrypted PKCS#7 input sent through IKEv1.

CVE-2026-78130 affects X.509 attribute-certificate validation in the x509 plugin and can cause a null-pointer crash when required issuer information is missing. The documented consequence is denial of service rather than remote code execution.

CVE-2026-78131 affects identity parsing in X.509 attribute certificates and can result in memory exhaustion. Product-, certificate-, parser-, daemon-health-, and network-specific evidence is required for reliable exploitation assessment.

CVE-2026-78132 affects ietfAttrSyntax parsing in X.509 attribute certificates and can produce an infinite loop and denial of service. The strongSwan advisory identifies versions beginning with 5.1.3 as affected.

CVE-2026-78133 affects IKEv2 Multi-KE rekey-collision handling in libcharon. The flaw can produce a use-after-free and potentially remote code execution. The vendor states that exploitation for potential RCE requires an authenticated peer and affected strongSwan versions beginning with 6.0.0.

CVE-2026-78134 affects EAP-PEAP and EAP-TTLS propagation of authentication details from inner EAP methods. The resulting identity mismatch can enable incorrect identity binding and potential authorization bypass. The attacker must authenticate successfully with valid credentials. Depending on configuration, the identity mismatch may affect authorization decisions, uniqueness enforcement, or virtual-IP assignment.

CVE-2026-78135 affects handling of CREATE_CHILD_SA requests on unestablished IKE SAs. The vendor states that an unauthenticated peer may potentially establish a usable Child SA before authentication completes. Affected versions begin with 5.9.7. This is the strongest pre-authentication trust-boundary condition in the September 7 strongSwan set.

The strongSwan vulnerabilities remain Coverage With Adaptation because reliable identification and compromise assessment require strongSwan-specific product and protocol evidence beyond the current generic remote-access detections. Version state, one crash, one EAP error, one certificate-processing event, one IKE rekey event, one CREATE_CHILD_SA request, or one observed Child SA does not independently establish exploitation. Local conclusions require the applicable combination of strongSwan version, plugin state, PKCS#7 or certificate context, EAP method and identity state, IKE SA and Child SA state, authenticated-peer context, Multi-KE and rekey activity, daemon-health and process evidence, network activity, VPN-session or tunnel state, downstream access, and incident-response findings.

The Check Point security advisory for CVE-2026-50751 supports the Check Point Remote Access VPN and Mobile Access Coverage With Adaptation entry. Check Point identifies CVE-2026-50751 as an authentication bypass affecting Remote Access VPN and Mobile Access deployments using deprecated IKEv1 key exchange under the applicable configuration conditions. Successful exploitation allows an unauthenticated remote attacker to establish a remote-access VPN connection without the expected valid user authentication.

Check Point states that exploitation was first observed on May 7, 2026 and increased in early June. The vendor describes the observed campaign as limited to a few dozen targeted organizations. Check Point reports that one case involved confirmed post-compromise activity associated with a Qilin ransomware affiliate and assesses with medium confidence that the actor behind the exploitation activity was financially motivated and associated with Qilin-related activity.

Rapid7 independently reports high-confidence exploitation observations for CVE-2026-50751 and provides additional detection and post-exploitation context. Rapid7 reports that CISA added CVE-2026-50751 to the Known Exploited Vulnerabilities Catalog in June 2026. These sources establish active exploitation and KEV urgency but do not independently prove exploitation of a particular local Check Point gateway.

Qilin ransomware-affiliate activity following CVE-2026-50751 exploitation is treated as Coverage With Adaptation. Check Point's assessment provides campaign and post-compromise context rather than universal attribution. Local Qilin attribution requires corroborating endpoint, payload, infrastructure, ransomware, forensic, victim-specific, or other attribution evidence.

The Cisco Secure Firewall ASA and FTD Remote Access SSL VPN advisory supports CVE-2026-20349. Cisco identifies the vulnerability as insufficient error checking in Remote Access SSL VPN HTTP-request processing that permits an unauthenticated remote attacker to cause an affected device to reload unexpectedly, resulting in denial of service. Cisco identifies affected IKEv2 Remote Access VPN with client services, SSL VPN, and applicable Zero Trust Network Access configurations as relevant exposure paths according to product and release.

Cisco states that in August 2026 its Product Security Incident Response Team became aware of active exploitation of CVE-2026-20349 and strongly recommends upgrade to a fixed release. CISA's KEV metadata identifies CVE-2026-20349 as a Known Exploited Vulnerability added on August 11, 2026. These authoritative exploitation-state updates materially increase remediation and retrospective-investigation urgency.

CVE-2026-20349 remains Coverage With Adaptation because its defining behavior is crafted HTTP input against Cisco Remote Access SSL VPN followed by unexpected device reload and availability impact. Reliable attribution requires Cisco product, vulnerable configuration, version, request, device-health, reload, network, and incident-response context beyond the currently implemented generic S25 behavior. Active exploitation and KEV status do not change the classification.

The Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026 supports the Coverage With Adaptation classifications for CVE-2026-20329, CVE-2026-20330, CVE-2026-20331, CVE-2026-20332, CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, and CVE-2026-20336. Cisco groups the CVEs by underlying vulnerability class: CVE-2026-20329 / CWE-703 improper handling of exceptional conditions; CVE-2026-20330 / CWE-707 structured-message or data validation; CVE-2026-20331 / CWE-693 protection-mechanism weakness; CVE-2026-20332 / CWE-284 improper access control; CVE-2026-20333 / CWE-697 security-relevant comparison; CVE-2026-20334 / CWE-710 coding-standard weakness; CVE-2026-20335 / CWE-682 incorrect calculation; and CVE-2026-20336 / CWE-664 improper resource-lifecycle control.

Cisco states that the hardening vulnerabilities affect Secure Firewall ASA Software, Secure FTD Software, and Secure FMC Software regardless of device configuration. The first fixed ASA releases are 9.16.4.103 for 9.16 and earlier, 9.18.4.94 for 9.18, 9.20.4.49 for 9.20, 9.22.3.26 for 9.22, 9.23.1.47 for 9.23, and 9.24.1.26 for 9.24. The first fixed Secure FTD and Secure FMC releases are 7.0.10 for 7.0 and earlier, 7.2.12 for 7.2, 7.4.8 for 7.4, 7.6.6 for 7.6, 7.7.13 for 7.7, 10.0.2 for 10.0, and 10.1.0 for 10.1.

The eight hardening CVE groupings are not individually classified as known exploited in this report. Cisco states that two underlying vulnerabilities within the CWE-284 vulnerability class represented by CVE-2026-20332 are actively exploited and directs customers to its separate Secure FMC Static Credential Vulnerability and Secure FMC Authentication Bypass Vulnerability advisories. Those separate vulnerabilities are CVE-2026-20316 and CVE-2026-20079. The active-exploitation status of CVE-2026-20316 and CVE-2026-20079 should not be generalized to CVE-2026-20329 through CVE-2026-20336.

The OpenVPN v2.7.7 release and corresponding CVE records support the Coverage With Adaptation classifications for CVE-2026-84732, CVE-2026-84256, CVE-2026-84226, CVE-2026-82312, CVE-2026-78221, CVE-2026-78043, and CVE-2026-81738. The affected scope reaches OpenVPN 2.6 releases through 2.6.22 and the 2.7 development line through 2.7.6, subject to CVE-specific lower-version boundaries, platform requirements, service-mode conditions, and configuration qualifications. OpenVPN 2.7.7 is the upstream remediation release, while maintained vendor and distribution security builds may provide the applicable remediation boundary for packaged deployments.

CVE-2026-84732 involves reliability-layer handling of TLS timeout and ACK state and can produce service disruption. CVE-2026-84256 involves Windows CreateProcess() quoting and argument parsing under a validation-script plus rogue-CA scenario and can permit command execution through crafted certificate-subject data. CVE-2026-84226 involves an unqualified netsh.exe invocation by tapctl and a local binary-planting path during network configuration. CVE-2026-82312 involves insecure permissions on Windows OpenVPN system objects and can allow local denial of service under affected service configurations. CVE-2026-78221 involves OpenVPN Windows service NRPT handling of UTF-8 internationalized domain names and can produce a buffer overread. CVE-2026-78043 involves Windows Interactive Service configuration-path validation and can permit an unauthorized configuration path to be used. CVE-2026-81738 involves DHCP DOMAIN-SEARCH handling and can produce a one-byte buffer overwrite.

These seven OpenVPN entries remain Coverage With Adaptation because reliable identification and compromise assessment require product- and platform-specific evidence beyond the current generic remote-access detections. OpenVPN version state or one service crash, netsh.exe execution, certificate subject, configuration path, NRPT event, DHCP option, IPC event, or service-object condition does not independently establish exploitation. Local conclusions require the applicable combination of OpenVPN platform, package and version, service mode, configuration, validation-script, CA and certificate, file and path, process and command-line, service-control, IPC, tapctl, netsh.exe, NRPT, DHCP, tunnel, authentication, session, fault, network, and incident-response evidence. Current authoritative evidence does not establish confirmed in-the-wild exploitation or CISA KEV status for the seven OpenVPN CVEs.

The SonicWall Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities (SNWLID-2026-0017), the corresponding CVE records, and CERT-FR CERTFR-2026-AVI-1275 support the Coverage With Adaptation classifications for CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, and CVE-2026-102258. SonicWall identifies the October 6, 2026 cohort as affecting SMA1000 releases through 12.4.3-03526 and 12.5.0-02952, with remediation in 12.4.3-03670 and 12.5.0-03082 or later. CERT-FR independently identifies remote-code-execution-related impact, server-side request forgery, and cross-site scripting among the documented risks and identifies SMA1000 versions before 12.4.3-03670 and 12.5 versions before 12.5.0-03082 as affected. Current authoritative reporting reviewed for this amendment does not establish active exploitation or CISA Known Exploited Vulnerabilities Catalog status for CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, or CVE-2026-102258. The four vulnerabilities remain Coverage With Adaptation because reliable identification and compromise assessment require SonicWall-specific product, version, request, authentication, application, appliance, network, process or execution, and incident-response evidence beyond the current generic remote-access detections. Vulnerable-version state or exposure alone does not independently establish exploitation or compromise.

The SonicWall Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities (SNWLID-2026-0016) supports the Direct Coverage classifications for CVE-2026-83548 and CVE-2026-83549. SonicWall identifies CVE-2026-83548 as a pre-authentication SSRF condition caused by unintended forward-proxy behavior in SMA1000 and assigns CVSS 10.0. The behavior maps directly to the existing external proxy or relay to appliance-local or prohibited-service detection path. SonicWall identifies CVE-2026-83549 as a post-authentication remote-code-execution vulnerability requiring administrative privileges and assigns CVSS 7.8. The behavior maps directly to existing appliance-administration and command-execution paths.

SonicWall states that CVE-2026-83548 and CVE-2026-83549 are being actively exploited in the wild. The affected products are SMA 1000 models 6210, 7210, and 8200v across all hypervisors on impacted 12.4.3-03453 and 12.5.0-02835 platform-hotfix lines. SonicWall identifies 12.4.3-03526 and 12.5.0-02952 as corrected versions. The vendor directs affected organizations to upgrade to the latest hotfix and contact SonicWall Technical Support for assistance reviewing the system for indicators of compromise. Where indicators of compromise are detected, SonicWall directs organizations to re-image hardware appliances or re-deploy virtual appliances, change all user and administrator passwords, and reset TOTP tokens. Vendor-confirmed active exploitation increases remediation and investigation urgency but does not independently prove compromise in a specific environment.

CISA added CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities Catalog on September 2, 2026. The CISA communication "CISA Adds Seven Known Exploited Vulnerabilities to Catalog" is the authoritative source for that KEV status and addition date. The KEV designations corroborate the already established active-exploitation urgency but do not change the existing Direct Coverage classifications and do not independently prove compromise of a local SMA1000 deployment.

The WatchGuard PSIRT advisories published on September 29-30, 2026 support the Coverage With Adaptation classifications for CVE-2026-86134, CVE-2026-86104, CVE-2026-18145, CVE-2026-13046, CVE-2026-86101, CVE-2026-86133, CVE-2026-13224, CVE-2026-86132, CVE-2026-86105, CVE-2026-90441, CVE-2026-86131, CVE-2026-86136, CVE-2026-81433, CVE-2026-86128, and CVE-2026-18105. The advisories establish the affected Fireware OS branches, corrected release boundaries, CVE-specific prerequisites, and the authentication, management, SAML, reverse-proxy, VPN, IKEv2, DHCP, NetFlow, diagnostic, spamd, samld, and wgagent behaviors represented in S39. The common corrected Default release boundaries are Fireware OS 2026.3.2, 2026.2.3, and 12.12.3, with 12.5.21 applying to the T15/T35 branch where identified; CVE-2026-13046 additionally uses EUCC 12.11.10 as its corrected EUCC boundary, and CVE-2026-81433 is represented only across the Default branches identified by WatchGuard. WatchGuard states that it is not aware of exploitation in the wild for the fifteen newly disclosed vulnerabilities. These references support remediation and Coverage With Adaptation but do not independently establish local exploitation or CISA KEV status.

The WatchGuard PSIRT advisories support the Coverage With Adaptation classification for CVE-2026-19318, CVE-2026-19315, and CVE-2026-19313. WatchGuard identifies all three as critical pre-authentication memory-safety vulnerabilities in the Fireware OS iked process that can be reached through specially crafted network traffic and may produce denial of service, memory corruption, and remote-code-execution potential. CVE-2026-19318 additionally requires IKE payload diagnostic logging to be enabled. The affected default Fireware branches are versions from 2025.0 below 2026.2.2 and 12.0 below 12.12.2, with T15/T35 releases from 12.0 below 12.5.20. Corrected releases are Fireware OS 2026.2.2, 12.12.2, and 12.5.20 as applicable.

WatchGuard states that it is not aware of exploitation in the wild for CVE-2026-19318, CVE-2026-19315, or CVE-2026-19313. The September 1, 2026 SecurityWeek reporting independently describes the three critical iked vulnerabilities and the corresponding corrected Fireware releases. These references support urgent remediation and Coverage With Adaptation but should not be interpreted as evidence of successful exploitation in a specific environment, known exploitation in the wild, or CISA KEV status. Local compromise conclusions require affected-product and version validation together with IKE activity, iked daemon-health or crash/respawn evidence, appliance telemetry, diagnostic-logging configuration where relevant, network evidence, or incident-response findings.

The WatchGuard PSIRT CVE-2025-14733 advisory identifies a critical out-of-bounds write in the Fireware OS iked process that can allow a remote unauthenticated attacker to execute arbitrary code against affected configurations. Documented exposure includes mobile-user VPN using IKEv2 and branch-office VPN using IKEv2 with a dynamic gateway peer. WatchGuard also documents a stale-configuration condition under which a Firebox can remain vulnerable after those configurations are removed if a branch-office VPN to a static gateway peer remains configured.

WatchGuard identifies affected default branches including Fireware OS versions >=2025.1 and <2025.1.4, >=12.0 and <12.11.6, and >=11.10.2 through 11.12.4+541730. Applicable corrected releases are 2025.1.4 or later, 12.11.6 or later, and releases later than 11.12.4+541730 for the legacy branch.

CISA's current Known Exploited Vulnerabilities record for CVE-2025-14733 identifies the vulnerability as used in known ransomware campaigns. This establishes elevated exploitation and ransomware-use urgency but does not independently establish successful exploitation of a specific Firebox, ransomware execution in a local environment, or attribution to a specific ransomware family. Local conclusions require affected Fireware product and version validation, relevant current or historical IKEv2 configuration state, IKE traffic, iked daemon-health or crash/respawn evidence, appliance telemetry, memory-corruption or execution evidence where available, downstream activity, and incident-response findings.

The Sygnia references support the Coverage With Adaptation classification for Fire Ant trusted-infrastructure compromise activity. They should not be interpreted as evidence that every Cisco IOS XR router, TACACS environment, Linux management host, or comparable trusted-infrastructure platform is compromised or that Fire Ant is definitively equivalent to UNC3886 solely because of behavioral or contextual overlap.

The Rapid7 and SonicWall references support the classifications for CVE-2026-15409, CVE-2026-15410, CVE-2025-23006, CVE-2025-32819, CVE-2025-32820, CVE-2025-32821, CVE-2024-40766, and related SonicWall activity. Confirmed exploitation reporting, ransomware association, public technical detail, or affected-version state increases remediation and investigation urgency but does not independently prove local compromise.

The Google Threat Intelligence Group reference supports the Coverage With Adaptation treatment of OVERSTEP and UNC6148 procedure sets. Appliance malware, credential theft, session-database access, persistence, log manipulation, or downstream identity abuse should not be inferred solely from vulnerable SonicWall appliance presence or campaign association without local or incident-specific evidence.

The Microsoft vulnerability records support the reusable network-reachable Windows RRAS RCE behavior family represented by the Direct Coverage register. Direct behavioral coverage means that the implemented S25 model can identify the common externally sourced network-to-RemoteAccess-service execution pathway when required telemetry is available. It does not mean the rule identifies the specific RRAS CVE used, detects memory-only exploitation universally, or establishes exploitation solely from vulnerable-version state.

The CISA Known Exploited Vulnerabilities Catalog and NVD support vulnerability-status, affected-product, and exploitation-state validation. CISA added BeyondTrust Remote Support CVE-2026-102764 to the Known Exploited Vulnerabilities Catalog on October 16, 2026, following documented in-the-wild exploitation associated with ARMORY CASTLE. The vulnerability remains Coverage With Adaptation because reliable identification requires BeyondTrust-specific appliance, internal messaging, file-operation, process, credential, session, network, and forensic evidence beyond the existing generic gateway detection framework. CVE-2025-14733, CVE-2025-53521, CVE-2026-50751, and CVE-2026-20349 are confirmed KEV entries. CISA's September 2, 2026 addition of CVE-2026-83548 and CVE-2026-83549 establishes their current KEV status. CVE-2026-94127 and CVE-2026-85102 are confirmed CISA KEV entries added on September 22, 2026. CVE-2026-88771 and CVE-2026-88772 are confirmed CISA KEV entries added on September 27, 2026, based on evidence of active exploitation. CVE-2026-88779 is a confirmed CISA KEV entry added on October 4, 2026, based on evidence of active exploitation. CISA added Ivanti Connect Secure CVE-2026-104935 to the Known Exploited Vulnerabilities Catalog on October 13, 2026, based on evidence of active exploitation, with an October 16, 2026 remediation deadline and applicable forensic-triage requirements. Ivanti identifies CVE-2026-104935 as an authentication-bypass-by-spoofing vulnerability that permits unauthenticated remote command execution in affected Connect Secure deployments and confirms limited exploitation in the wild at disclosure. The vulnerability remains Coverage With Adaptation because reliable identification requires Ivanti-specific affected-product and version validation, authentication and request evidence, appliance execution and configuration telemetry, network activity, downstream identity or infrastructure activity, and incident-response findings beyond the existing generic S25 gateway detection families. These KEV states increase remediation, retrospective-hunting, and compromise-assessment urgency but do not change the applicable Direct Coverage or Coverage With Adaptation classifications or independently establish successful exploitation of a specific local gateway deployment. Current authoritative evidence reviewed for this amendment does not establish CISA KEV status for CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258, CVE-2026-78626, or CVE-2026-85103. Check Point confirms active exploitation attempts for CVE-2026-85102 beginning September 12, 2026, while continuing to report no indication of active exploitation for CVE-2026-85103. CISA identifies CVE-2025-14733 as used in known ransomware campaigns, but current authoritative evidence does not identify a specific ransomware family. KEV inclusion, vendor priority, CVSS severity, vulnerable-version state, public exploit availability, actor association, ransomware association, or absence from KEV should be treated as remediation and investigation context rather than standalone proof of successful exploitation.