--- title: "62 VPN gateway flaws on CISA's exploited list, 34 used in ransomware" summary: "Remote-access gateway entries in CISA's Known Exploited Vulnerabilities catalogue, November 2021 to September 2026, counted by vendor, and what replaces the VPN." url: https://www.thetechbag.com/blog/best-practices-cybersecurity-remote-work-era format: Note desk: "Security operations" published: 2025-03-26 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["remote work","VPN","CISA KEV","ZTNA","Ivanti","Citrix NetScaler","SonicWall","ransomware","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/best-practices-cybersecurity-remote-work-era.png --- # 62 VPN gateway flaws on CISA's exploited list, 34 used in ransomware *Remote-access gateway entries in CISA's Known Exploited Vulnerabilities catalogue, November 2021 to September 2026, counted by vendor, and what replaces the VPN.* Note · Security operations · By TechBag · Published 2025-03-26 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/best-practices-cybersecurity-remote-work-era The remote-work practice that has aged worst since 2023 is the one this piece put third: make every remote employee connect through a VPN. We counted 62 entries in CISA’s Known Exploited Vulnerabilities catalogue, up to 30 September 2026, for the gateways remote workers connect through: SSL-VPN and remote-access appliances from nine vendors. CISA marks 34 of the 62 as known to have been used in ransomware campaigns, and 25 were added from January 2025 onward.[1] The 2023 version also quoted Gartner, Buffer, Accenture and Juniper Research figures that we could not trace to the original reports; they are gone. The other practices it listed, strong passwords with two-factor authentication, prompt updates, encryption, device management and an incident plan, still hold. The question worth answering now is what to do about the door itself. ## The gateway is the most exploited thing a remote worker touches The pattern is steady, not historic. In 2025 CISA added Ivanti Connect Secure (CVE-2025-0282, 8 January), Citrix NetScaler Gateway (CVE-2025-5777, 10 July) and Cisco’s ASA VPN web server (CVE-2025-20333 and 20362, 25 September). In 2026 it added twelve more, including a Check Point flaw that let an attacker “establish a remote access VPN connection without a valid user password” (CVE-2026-50751, 8 June).[1] A remote-access gateway sits on the internet by design, holds every user’s session, and is often patched last. **Figure: Three vendors account for 43 of the 62 exploited remote-access gateway flaws** *CISA KEV entries for SSL-VPN and remote-access gateways, by vendor, November 2021 to September 2026* Citrix NetScaler 16 entries Ivanti (incl. Pulse Secure) 14 entries SonicWall 13 entries Fortinet 6 entries Cisco 5 entries Check Point 3 entries Palo Alto Networks 3 entries Array Networks 1 entries WatchGuard 1 entries | | Value (entries) | | --- | --- | | Citrix NetScaler | 16 | | Ivanti (incl. Pulse Secure) | 14 | | SonicWall | 13 | | Fortinet | 6 | | Cisco | 5 | | Check Point | 3 | | Palo Alto Networks | 3 | | Array Networks | 1 | | WatchGuard | 1 | Source: CISA Known Exploited Vulnerabilities catalogue, TechBag count · as of 30 September 2026 · a count of exploited flaws, not of risk per customer: vendors with larger installed bases attract more attention TechBag countTechBag count We took every KEV entry added on or before 30 September 2026 (1,730 in all) whose name or description names a VPN, SSL-VPN, GlobalProtect, Connect Secure, Secure Mobile Access or a NetScaler Gateway, then removed thirteen that are not the remote-access gateway itself: VPN client software, branch routers, router operating systems, firewall-only models and two management-interface flaws. 62 remain. ## What replaces the VPN, and what it cannot reach Zero trust network access connects a user to one application through a broker instead of putting the device on the network. TechBag’s ZTNA guide, as it stood on 30 September 2026, compares 14 products from 11 vendors. Only 2 of the 14 document support for server-initiated protocols such as on-premises VoIP and SCCM: Netskope natively, Zscaler through a separate Network Connector. For the rest, a VPN usually survives for the one application the broker cannot carry.[2] Our view Our view: retire the concentrator for everything the broker can carry, keep a dated exception list for the rest, and patch whatever gateway remains within days of a KEV listing, not at the next maintenance window. Note that Cisco, Check Point and Palo Alto Networks appear both in the chart and in the ZTNA guide; buying the replacement from the gateway vendor is fine, provided the old gateway is actually switched off. TechBag sells Zscaler and Netskope. ## Buying it in India Most ZTNA is priced per user in US dollars, invoiced in rupees through a reseller with 18% GST. Cloudflare Access is free to 50 users and then US$7 a user a month; Seqrite ZTNA and InstaSafe’s application-access product, both India-built, are quoted in rupees. Four products in the guide document Indian points of presence and three are India-built or India-hosted.[2] CERT-In’s Directions of 28 April 2022 require a reportable incident, a list that includes unauthorised access to IT systems, to reach CERT-In within six hours, and ICT logs to be kept for 180 days within Indian jurisdiction.[3] The DPDP Rules, notified on 13 November 2025, bring the security-safeguard and breach-notice duties into force on 13 May 2027.[4] How we did this Figures as of 30 September 2026 The gateway count is TechBag’s count of CISA’s KEV catalogue, using each entry’s date added and its ransomware field; the catalogue began in November 2021, so its first batch includes older flaws. The counting rule and exclusions are in the count box above. The ZTNA figures are TechBag’s zero trust access guide as committed on 30 September 2026 (vendor documentation verified 22 August 2026). The Gartner, Buffer, Accenture and Juniper figures in the 2023 post were not traced to source and were removed. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [CISA, Known Exploited Vulnerabilities catalogue (JSON feed), entries dated to 30 September 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) — 30 September 2026 2. [TechBag, Zero trust access (ZTNA) guide: 14 products, reach, India presence and prices](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) — verified 22 August 2026 3. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; 180-day logs)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 4. [MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025](https://www.meity.gov.in/data-protection-framework) — 13 November 2025 Related on TechBag: the [zero trust access guide](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) for the 14 products by reach, and the [InstaSafe ZTNA page](https://www.thetechbag.com/instasafe/instasafe-ztna) for an India-built option quoted in rupees. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Zero trust access (ZTNA) guide](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) — 14 products by protocol reach, India presence and price - [InstaSafe ZTNA intel page](https://www.thetechbag.com/instasafe/instasafe-ztna) — an India-built option - [Netskope One Private Access](https://www.thetechbag.com/netskope/netskope-private-access) — documents server-initiated protocols and Indian data centres