Is my firewall a security risk?

Any internet-facing appliance is a risk if its firmware is out of date or its management interface is reachable. Through 2026, edge devices from Fortinet, Palo Alto, SonicWall and Citrix have been the leading initial-access route for ransomware operators. The device itself is not the problem; unpatched firmware and exposed management are.

How quickly should firewall firmware be patched?

For a vulnerability with confirmed exploitation in the wild, days rather than weeks. CVE-2026-8451 in Citrix NetScaler was exploited within 24 hours of public disclosure. For routine updates, a monthly maintenance window is a reasonable baseline.

Does changing firewall brand fix this?

No. Every major vendor has shipped a critical edge vulnerability. What changes the outcome is whether someone owns patching, whether the management plane is exposed, and whether VPN accounts have MFA.

A 2026 campaign that harvested credentials from exposed Fortinet devices. Reporting put roughly 74,000 stolen credentials in circulation, with confirmed ransomware infections traced back to the compromised appliances.

The Firewall Became the Way In

Short version: through 2026 the firewall and the VPN concentrator stopped being the thing that keeps attackers out and became the thing they come in through. If you cannot say when your edge firmware was last updated, that is the finding.

There is a particular kind of bad news that lands badly with clients, and it is this one: the box you bought to keep attackers out was how they got in.

That has been the shape of 2026. Coordinated exploitation of edge VPN and firewall appliances - Palo Alto Networks, Fortinet, Citrix, Check Point - became the dominant initial-access route for ransomware crews, according to reporting on the campaign. Not phishing. Not a laptop. The perimeter device itself.

What actually happened

Four incidents are worth knowing by name, because they show the pattern rather than just the volume.

FortiBleed. A credential-harvesting campaign against exposed Fortinet devices that, by Sophos’ account, left around 74,000 stolen credentials circulating and produced at least a dozen confirmed ransomware infections traced back to the appliances. The firewall did not fail to block an attack. The firewall was the attack.

Palo Alto CVE-2026-0257. Disclosed on 13 May as medium severity. Reassessed as critical shortly afterwards once Rapid7 confirmed active exploitation, per CyberScoop. If your patching policy is “critical only”, note what happened here: the rating moved after people had already decided to skip it.

SonicWall SMA1000. CVE-2026-15409 and CVE-2026-15410, chainable to full remote code execution, both added to the US CISA known-exploited catalogue.

Citrix NetScaler CVE-2026-8451. Exploited in the wild within 24 hours of disclosure. Twenty-four hours. That is the number to hold onto when someone proposes a quarterly patch cycle.

Why edge devices, and why now

Three reasons, none of them complicated.

They are always exposed. That is their job. There is no “behind the firewall” for the firewall.
They are rarely monitored. Most environments we inherit have endpoint agents everywhere and nothing watching the appliance itself. When it is compromised, nothing tells you.
Nobody owns them. Servers get patched because someone owns servers. The firewall was installed by a vendor three years ago, works fine, and has no owner. That is the gap being exploited.

Groups including affiliates of the Qilin ransomware-as-a-service operation have been chaining authentication-bypass flaws with credential harvesting and legacy protocol weaknesses to reach corporate perimeters without needing valid credentials at all.

What we would actually change

None of this requires new spend. In order of how much risk it removes per hour of effort:

1. Take the management interface off the internet

If your firewall’s admin page answers from a public IP, that is the first thing to fix, today. Management belongs on an internal VLAN or behind a VPN - never published. A meaningful share of edge compromises we read about start here, and it is a configuration change, not a purchase.

2. Find out what firmware you are running

Not what you think you are running. Log in and check, on every site. In multi-site environments we frequently find the head office current and a branch two major versions behind, because the branch cutover happened during a busy week and nobody circled back.

3. Put MFA on every VPN account

Credential-harvesting campaigns are only useful if the stolen credential still works alone. MFA on remote access turns 74,000 stolen credentials into 74,000 useless strings. Most modern firewalls include this - it is frequently bought and never enabled.

4. Set a real patch window

Monthly for routine firmware. Days, not weeks, for anything with confirmed exploitation. Write down who decides and who executes. Managed patching exists precisely because this is the task that slips when everyone is busy.

5. Audit the rule base while you are in there

Firmware is one half. The other is the rules that accumulated over three years - the temporary any-any that became permanent, the port opened for a supplier who left in 2024. A rule review usually surfaces more real exposure than the CVE list does.

The uncomfortable part

We sell firewall deployment. It would be commercially convenient to say the answer is a newer firewall. It is not.

Every major vendor on that list - including the ones we deploy and partner with - shipped a critical edge vulnerability this year. Switching brand moves you to a different vendor’s advisory feed, nothing more. What actually separates the businesses that got hit from the ones that did not was mundane: someone owned the device, patched it on a schedule, kept management off the internet, and required MFA.

That is an operations problem, not a procurement problem. It is also the reason we would rather audit what you already own than sell you a replacement for it.

If you do one thing this week

Log into every internet-facing firewall you own and write down the firmware version and the date it was last updated. Not an audit. Just a list.

In our experience that single exercise finds something on more than half of the networks we are handed - usually a branch appliance, usually forgotten, usually reachable from the internet.

The firewall became the way in