Log in Request a demo

Threat Intelligence Researches

Five edge VPN flaws CISA flags for ransomware use

Five VPN and firewall flaws added to CISA KEV in 2025 and 2026 carry a ransomware flag. Dates, fixed versions and what to check on your own edge devices.

Updated 4 Min Read

Five flaws in VPN and firewall products, added to the CISA Known Exploited Vulnerabilities (KEV) catalog between February 2025 and June 2026, carry the flag “known ransomware campaign use”. Each sits on a device that faces the internet, so one unpatched bug gives an outsider a way in. This article lists the five, the dates, the fixes and what to check.

Which edge VPN flaws carry the ransomware flag?

The five are CVE-2024-53704 in SonicWall SonicOS, CVE-2025-22457 in Ivanti Connect Secure, CVE-2025-14733 in WatchGuard Firebox, CVE-2026-0257 in Palo Alto Networks PAN-OS and CVE-2026-50751 in Check Point Security Gateway. Three let an attacker skip the VPN login. The other two are memory errors: an out-of-bounds write in WatchGuard and a buffer overflow in Ivanti, where a program writes more data than a reserved space can hold. All five are rated 9.1 or higher by NVD or the vendor.

From KEV listing to KEV listing
  1. 18 Feb 2025SonicWall SonicOS SSLVPNCISA adds CVE-2024-53704 to KEV. SonicWall had said on 30 January 2025 that public test code was available.
  2. 4 Apr 2025Ivanti Connect SecureCISA adds CVE-2025-22457 one day after Ivanti’s advisory of 3 April 2025, which said a limited number of customers had been exploited.
  3. 19 Dec 2025WatchGuard FireboxWatchGuard publishes its advisory and CISA adds CVE-2025-14733 on the same day.
  4. 29 May 2026PAN-OS GlobalProtectCISA adds CVE-2026-0257. The vendor had published its advisory on 13 May 2026 and reports limited exploit attempts.
  5. 8 Jun 2026Check Point remote access VPNVendor advisory and KEV listing for CVE-2026-50751 on the same day. The vendor saw the earliest exploitation on 7 May 2026.

Which versions fix them?

Each vendor names its own fixed builds, and you should read the advisory for your exact train. As the pages on these flaws record them:

  • SonicOS: 7.0.1-5165 and higher, 7.1.3-7015 and higher, and 8.0.0-8037 and higher for the TZ80.
  • Ivanti Connect Secure: 22.7R2.6 or later. Policy Secure needs 22.7R1.5 and ZTA Gateways 22.8R2.2. Pulse Connect Secure 9.1x gets no fix and must be replaced.
  • WatchGuard Fireware OS: 2025.1.4, 12.11.6, 12.5.15 (T15 and T35) and 12.3.1-b728352 (FIPS).
  • PAN-OS: for example 12.1.7, 11.2.12, 11.1.15 or 10.2.18-h6 or later, or the hotfix named in the advisory.
  • Check Point: the hotfix in advisory sk185033. Versions R80.20.X to R81.10 are end of support and need an upgrade first.
Warning: The patch date is not the start dateCheck Point saw exploitation from 7 May 2026, a month before its advisory. Ivanti had shipped its fix on 11 February 2025, about seven weeks before it said customers had been exploited. Audit VPN logs back before the advisory date.

Who is exploiting these flaws?

The official sources opened for these pages do not name the actors for four of the five. The KEV entries only flag ransomware use. For the Check Point flaw, the vendor says one case showed confirmed activity after the break-in linked to a Qilin ransomware affiliate, and it assesses with medium confidence that the actor is financially motivated. That is a vendor statement, and no government source opened here names an actor. The vendor also says some attacks on Taiwanese organizations used attacker servers in Taiwan.

What should a security team check first?

Start with an inventory: which of these five products do you run, and which faces the internet? Then work through the list below. Each point comes from the vendor or CISA guidance for these flaws.

Checks for your edge devices
  1. Patch or replaceMove to the fixed builds above. Replace end-of-support models, such as Pulse Connect Secure 9.1x.
  2. Run the integrity toolsFor Ivanti, run the external Integrity Checker Tool. If it shows compromise, isolate, image and factory reset the device.
  3. Cut exposure if you cannot patchSonicWall says to disable SSLVPN or limit it to trusted sources. Palo Alto Networks offers a cookie mitigation for GlobalProtect.
  4. Rotate secrets after a suspected attackWatchGuard says an attacker takes the configuration file, which holds stored secrets. CISA asks Ivanti owners to reissue keys and passwords.
  5. Hunt in the logsLook for VPN sessions without a normal login trail, and use the indicators in each vendor advisory.

How can monitoring help?

The gap between a fix and a listing as exploited is short, and in the Check Point case exploitation began before any advisory. Watching vendor advisories and the KEV catalog for the products you run tells you which edge device to patch first. Threat intelligence monitoring can also flag exposed VPN credentials that an attacker would use after a bypass. No tool replaces patching, but a short list of exposed products and a named owner for each shortens the time you stay open.

Last checked against sources on 9 October 2026.

Frequently Asked Questions.

Which edge VPN flaws are flagged for ransomware use by CISA?

CVE-2024-53704 (SonicWall), CVE-2025-22457 (Ivanti), CVE-2025-14733 (WatchGuard), CVE-2026-0257 (PAN-OS) and CVE-2026-50751 (Check Point). CISA added them to KEV between 18 February 2025 and 8 June 2026.

Does CISA name the ransomware group behind these flaws?

No. The KEV entries only flag ransomware campaign use. For the Check Point flaw, the vendor links one case to a Qilin affiliate and says so with medium confidence.

How do I know if my Ivanti Connect Secure was compromised?

Ivanti says to run its external Integrity Checker Tool. If it shows compromise, CISA and Ivanti advise isolating the device, taking a forensic image, a factory reset and loading 22.7R2.6.

What should I do if I cannot patch a SonicWall firewall now?

SonicWall says to disable SSLVPN, or limit access to trusted sources and not expose it to the whole internet.

Sources

  1. 1 SonicWall advisory SNWLID-2025-0003
  2. 2 CISA mitigation instructions for CVE-2025-22457
  3. 3 WatchGuard advisory for CVE-2025-14733
  4. 4 Palo Alto Networks advisory for CVE-2026-0257
  5. 5 Check Point advisory for CVE-2026-50751
  6. 6 CISA Known Exploited Vulnerabilities catalog
Share

In This Article

Ransomware groupsQilin VulnerabilitiesSonicWall SonicOS SSLVPN authentication bypass (CVE-2024-53704) VulnerabilitiesIvanti Connect Secure buffer overflow (CVE-2025-22457) VulnerabilitiesWatchGuard Firebox iked out-of-bounds write (CVE-2025-14733) VulnerabilitiesPAN-OS GlobalProtect authentication bypass (CVE-2026-0257) VulnerabilitiesCheck Point VPN login bypass (CVE-2026-50751) TermsKnown Exploited Vulnerabilities (KEV) catalog TermsRansomware

Where To Next.

All Threat Intelligence Researches Articles
In plain words · Glossary term Known Exploited Vulnerabilities (KEV) catalog The Known Exploited Vulnerabilities (KEV) catalog is a list of vulnerabilities that have been exploited in real attacks. Open → Keep reading · Article Remote support and file transfer flaws in ransomware attacks SimpleHelp, CrushFTP, GoAnywhere and BeyondTrust flaws were flagged by CISA for ransomware use in 2025 and 2026. Dates, fixes, attribution and checks. Open → Keep reading · Article Two Fortinet events of 2026: what to check Fortinet had two 2026 events: a January SSO login flaw and a June wave of leaked logins. See what a firewall owner checks, from… Open →

Knowledge HubRansomware groups