[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCvmQ40N5ycLZjB5bUA2UudOMZeMMd0kGScRrEnWxC1Q":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"6a80604a-2f08-4e85-b5b0-12a7bb51df66","70000-credentials-stolen-via-unpatched-edge-firewalls-and-vpns","8bc54ec0-7f91-4f7e-8f9d-08bbebc40f6e","70,000 Credentials Stolen via Unpatched Edge Firewalls and VPNs","Attackers exploited vulnerabilities in widely deployed network edge devices — Fortinet FortiGate and Palo Alto Networks GlobalProtect — to breach enterprise perimeters and harvest over 70,000 sets of credentials. These devices sit at the outermost layer of corporate networks, making them high-value targets whose compromise can grant attackers direct access to internal systems. The root cause lies in organizations failing to apply available patches and maintain rigorous vulnerability management for internet-facing appliances. This matters enormously because stolen credentials from perimeter devices can enable lateral movement, ransomware deployment, and prolonged undetected access across entire organizations.","**Immediate actions:**\n- Apply all vendor-released patches and firmware updates for Fortinet FortiGate and Palo Alto GlobalProtect devices without delay.\n- Audit all exposed edge devices for known vulnerabilities using authenticated scans and vendor-provided security advisories.\n- Force a credential reset for all accounts whose credentials may have been exposed through the compromised devices.\n\n**Long-term improvements:**\n- Establish a formal, time-bound emergency patching SLA (e.g., 24–72 hours) specifically for critical internet-facing infrastructure.\n- Maintain a continuously updated inventory of all network perimeter appliances, including firmware versions and patch status.\n- Implement network segmentation so that a breached edge device cannot provide direct, unrestricted access to internal systems.\n\n**Detection measures:**\n- Deploy centralized logging and SIEM alerting for anomalous authentication events on all VPN and firewall systems.\n- Subscribe to vendor threat intelligence feeds and monitor for indicators of compromise (IoCs) associated with active exploitation campaigns targeting your device models.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","OWASP A06:2021 Vulnerable and Outdated Components","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 17: Incident Response Management":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates that essential entities implement vulnerability handling and patching policies; the failure to patch critical network edge devices represents a direct gap against this requirement.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined timeline — enforcing this for perimeter devices would have closed the attack window.","The scale of the breach and the ongoing attempts to further compromise victims highlight the need for a mature incident response plan capable of quickly detecting, containing, and remediating perimeter device compromises.","Running unpatched versions of enterprise firewall and VPN software is precisely what this category warns against, as known vulnerabilities in these components were the primary attack vector.","Regular, automated scanning and a disciplined patch cadence for internet-facing devices would have identified and remediated the exploited vulnerabilities before attackers could leverage them.","This control explicitly requires timely identification and remediation of technical vulnerabilities in assets, directly addressing the failure to patch the exploited firewall and VPN devices.","With over 70,000 credentials exposed, strong identity protections such as MFA on VPN and firewall management interfaces would have limited the impact of stolen credentials.","published","2026-10-23T15:21:07.833563+00:00","2026-10-23T15:21:07.817+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhackers-breach-enterprise-firewalls-and.html","hackers-breach-enterprise-firewalls-and-vpns-exposing-over-70-000-credentials-64b0ac","Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,53,56],{"slug":50,"name":51,"problem":52},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":38,"name":54,"problem":55},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":57,"problem":58},"Automated patch management","Known holes get closed in days, not months."]