62 VPN gateway flaws on CISA's exploited list, 34 used in ransomware
Remote-access gateway entries in CISA's Known Exploited Vulnerabilities catalogue, November 2021 to September 2026, counted by vendor, and what replaces the VPN.
The remote-work practice that has aged worst since 2023 is the one this piece put third: make every remote employee connect through a VPN. We counted 62 entries in CISA’s Known Exploited Vulnerabilities catalogue, up to 30 September 2026, for the gateways remote workers connect through: SSL-VPN and remote-access appliances from nine vendors. CISA marks 34 of the 62 as known to have been used in ransomware campaigns, and 25 were added from January 2025 onward.1
The 2023 version also quoted Gartner, Buffer, Accenture and Juniper Research figures that we could not trace to the original reports; they are gone. The other practices it listed, strong passwords with two-factor authentication, prompt updates, encryption, device management and an incident plan, still hold. The question worth answering now is what to do about the door itself.
01The gateway is the most exploited thing a remote worker touches
The pattern is steady, not historic. In 2025 CISA added Ivanti Connect Secure (CVE-2025-0282, 8 January), Citrix NetScaler Gateway (CVE-2025-5777, 10 July) and Cisco’s ASA VPN web server (CVE-2025-20333 and 20362, 25 September). In 2026 it added twelve more, including a Check Point flaw that let an attacker “establish a remote access VPN connection without a valid user password” (CVE-2026-50751, 8 June).1 A remote-access gateway sits on the internet by design, holds every user’s session, and is often patched last.
Three vendors account for 43 of the 62 exploited remote-access gateway flaws
CISA KEV entries for SSL-VPN and remote-access gateways, by vendor, November 2021 to September 2026
Source: CISA Known Exploited Vulnerabilities catalogue, TechBag count · as of 30 September 2026 · a count of exploited flaws, not of risk per customer: vendors with larger installed bases attract more attention
02What replaces the VPN, and what it cannot reach
Zero trust network access connects a user to one application through a broker instead of putting the device on the network. TechBag’s ZTNA guide, as it stood on 30 September 2026, compares 14 products from 11 vendors. Only 2 of the 14 document support for server-initiated protocols such as on-premises VoIP and SCCM: Netskope natively, Zscaler through a separate Network Connector. For the rest, a VPN usually survives for the one application the broker cannot carry.2
03Buying it in India
Most ZTNA is priced per user in US dollars, invoiced in rupees through a reseller with 18% GST. Cloudflare Access is free to 50 users and then US$7 a user a month; Seqrite ZTNA and InstaSafe’s application-access product, both India-built, are quoted in rupees. Four products in the guide document Indian points of presence and three are India-built or India-hosted.2 CERT-In’s Directions of 28 April 2022 require a reportable incident, a list that includes unauthorised access to IT systems, to reach CERT-In within six hours, and ICT logs to be kept for 180 days within Indian jurisdiction.3 The DPDP Rules, notified on 13 November 2025, bring the security-safeguard and breach-notice duties into force on 13 May 2027.4
Sources
- CISA, Known Exploited Vulnerabilities catalogue (JSON feed), entries dated to 30 September 2026 — 30 September 2026
- TechBag, Zero trust access (ZTNA) guide: 14 products, reach, India presence and prices — verified 22 August 2026
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; 180-day logs) — 28 April 2022
- MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 — 13 November 2025
Related on TechBag: the zero trust access guide for the 14 products by reach, and the InstaSafe ZTNA page for an India-built option quoted in rupees.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
