Vulnerability exploitation is playing a growing role in corporate breaches, according to new incident response findings published on 28 October 2026. The latest evidence points particularly to known flaws in internet-facing security and remote access appliances.
Vulnerability exploitation rises in Q3 investigations
LevelBlue’s Q3 2026 TTP Briefing found that exploited vulnerabilities accounted for 14 per cent of initial access across its incident response cases. That was a marked increase from 4 per cent in Q2, although it remained below the 20 per cent recorded in Q1.
Phishing and social engineering remained the leading initial access method in LevelBlue’s Q3 investigations, accounting for 42 per cent of cases. However, this was down from 65 per cent in Q2, while vulnerability exploitation regained ground as a route into corporate networks.
The quarterly changes should not be interpreted as a single, uninterrupted rise. Instead, they show that exploitation can fluctuate sharply across incident response casework while remaining a significant cause of intrusions. LevelBlue identified known vulnerabilities in edge devices as prominent targets in both Q1 and Q3.
The findings reinforce a broader shift reported earlier in the year. Verizon’s 2026 Data Breach Investigations Report, released on 19 May 2026, found that vulnerability exploitation was involved in 31 per cent of breaches, up from 20 per cent the previous year. It overtook credential abuse for the first time in the report’s history.
The Verizon and LevelBlue percentages describe different datasets and should not be compared as if they were a single measurement. Verizon draws on evidence from multiple incident response providers and law enforcement organisations, while LevelBlue reports on its own casework. Nevertheless, both identify exploitation as a major initial access route.
Why internet-facing edge devices are being targeted
Much of the 2026 activity has centred on VPNs, firewalls and remote access gateways. These systems are exposed to the internet by design and often provide trusted access to internal networks, making vulnerability exploitation particularly valuable to attackers.
A successful exploit can remove the need to trick an employee, defeat an email filter or generate a multi-factor authentication prompt. Pre-authentication and authentication bypass flaws are especially dangerous because an attacker may be able to compromise an appliance without possessing a valid account.
Several characteristics increase the attraction of edge devices:
- They are continuously reachable from the public internet.
- They often sit at the boundary between external and trusted networks.
- They may receive less endpoint monitoring than conventional servers.
- Older or forgotten appliances can remain online after support ends.
- Compromise can provide a direct foothold for data theft and further movement.
Government and industry reporting throughout 2026 has documented sustained exploitation against products from Palo Alto Networks, Ivanti, SonicWall, Fortinet and BeyondTrust. On 5 February 2026, CISA also issued Binding Operational Directive 26-02 addressing the risks created by end-of-support edge devices.
Edge appliance vulnerabilities exploited during 2026
Palo Alto Networks PAN-OS
CVE-2026-0322 is an authenticated remote code execution vulnerability in the PAN-OS management interface. It can allow an authenticated, network-adjacent attacker to execute code as root. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 14 October 2026, confirming evidence of exploitation.
Although authentication is required, attackers may combine the flaw with stolen sessions or weak credentials. The advisory information covered by the October reporting did not provide a universal indicator set or a complete affected-version list, so administrators need to check the vendor advisory against each deployed PAN-OS release.
Ivanti Connect Secure
Ivanti disclosed CVE-2026-104935 on 13 October 2026 and confirmed exploitation in the wild. The authentication bypass by spoofing affects Ivanti Connect Secure versions before 25.1.3.0 and can enable remote, unauthenticated command execution on the appliance.
Ivanti noted that some older 22.7R2.14 builds are not affected, making precise version validation important. Organisations should not assume that a numerically older release is vulnerable without checking the product advisory and its applicable build information.
SonicWall SMA 1000
SonicWall disclosed two related SMA 1000 vulnerabilities on 1 and 2 September 2026. CVE-2026-83548 is a pre-authentication server-side request forgery flaw in the WorkPlace interface, while CVE-2026-83549 is an operating system command injection vulnerability.
The first flaw allows an attacker to use an unintended access path to make internal HTTP requests and reach privileged functions. When chained with the command injection issue, the vulnerabilities can provide unauthenticated remote code execution. Both were added to CISA’s Known Exploited Vulnerabilities catalogue on 2 September 2026.
Affected firmware includes 12.4.3-03453 and older, and 12.5.0-02835 and older, on SMA 6210, 7210 and 8200v appliances. SonicWall’s remediation guidance includes re-imaging or redeploying affected systems and resetting credentials and time-based one-time password tokens.
BeyondTrust Remote Support
CVE-2026-102764 affects self-hosted BeyondTrust Remote Support appliances. BeyondTrust disclosed the issue on 15 October 2026 after prior in-the-wild exploitation. The weakness involves improper origin validation in internal messaging and can enable authentication bypass, arbitrary file operations and web shell uploads.
Versions 26.2.3 and earlier require the BT26-05-RS patch. Customers running versions older than 24.3.1 must first upgrade to a release capable of applying the fix. BeyondTrust patched its software as a service environment on 9 October 2026, while self-hosted customers remained responsible for updating their own appliances.
How the exploitation leads to wider breaches
These cases illustrate why vulnerability exploitation can be an efficient first step in a multi-stage intrusion. An attacker scans for an exposed product, identifies its version or behaviour, and sends crafted requests that trigger an authentication bypass, internal request or command execution flaw.
Successful exploitation can provide privileged access directly on the gateway. Attackers can then establish persistence, upload a web shell, steal credentials, inspect network traffic or move towards systems holding sensitive data. This route can bypass the email-focused controls designed to detect phishing.
Public advisories for the cited vulnerabilities have generally prioritised patching, re-imaging and configuration resets rather than publishing universal indicators of compromise. Known Exploited Vulnerabilities catalogue inclusion confirms active exploitation, but it does not mean public proof-of-concept code or complete forensic indicators are available.
What organisations should do now
Organisations should identify every internet-facing VPN, firewall, management interface and remote support appliance, then compare its exact model, firmware and support status with current vendor advisories. Priority should go to the actively exploited vulnerabilities and affected versions described above.
- Apply the relevant Ivanti, SonicWall, Palo Alto Networks and BeyondTrust fixes.
- Remove management interfaces from public access wherever possible.
- Follow vendor instructions for re-imaging, redeployment and credential resets.
- Review affected appliances for unexpected files, web shells and configuration changes.
- Replace end-of-support edge equipment that cannot receive security updates.
The Q3 figures do not mean phishing has been displaced in every environment. They show that vulnerability exploitation now demands comparable attention, especially where an exposed edge appliance can provide attackers with immediate access to trusted networks.
Originally reported by csoonline.com.
