The Edge Is Becoming the New Endpoint

Executive Summary

September 2026 provides unusually strong evidence for a security trend that has been developing for years: attackers increasingly value infrastructure sitting between the internet and internal enterprise networks.

Within weeks, confirmed exploitation affected Cisco Identity Services Engine, Cisco Secure Email Gateway, F5 BIG-IP APM, MikroTik RouterOS, Check Point security products and Arista VeloCloud Orchestrator. CISA’s September 22 KEV update alone added exploited vulnerabilities affecting Check Point, VeloCloud and F5.

These products perform different jobs, but they share useful characteristics from an attacker’s perspective: privileged network position, internet reachability, stored credentials and configuration, limited endpoint visibility, and trusted relationships with internal systems.

The edge is not replacing the endpoint.

But for attackers looking for durable, privileged access, the edge increasingly behaves like one—without always receiving equivalent monitoring.

The Evidence

Any claim that attackers are “moving to the edge” should be supported by more than a handful of CVEs.

September’s disclosures nevertheless form a notable cluster.

Cisco ISE — CVE-2026-76460

Cisco confirmed active exploitation of a CVSS 10 authentication bypass affecting ISE and ISE-PIC.

The vulnerability allows unauthenticated access through a management API authentication failure.

Cisco Secure Email Gateway — CVE-2026-76461

Cisco confirmed exploitation of an unauthenticated SQL injection triggered through email parsing.

Successful exploitation can result in root command execution.

CISA added it to KEV on September 14.

MikroTik RouterOS

CERT Polska observed attackers targeting internet-accessible RouterOS SSH services and confirmed exploitation capable of obtaining full control of routers.

F5 BIG-IP APM — CVE-2026-94127

F5 disclosed an unauthenticated heap overflow capable of remote code execution against certain APM/OAuth configurations.

F5 confirmed exploitation, and CISA added the vulnerability to KEV.

Check Point

Check Point reported active exploitation of CVE-2026-85102 and CVE-2026-93616 affecting security infrastructure including Security Gateway and management products.

Both vulnerabilities entered CISA KEV on September 22.

Arista VeloCloud Orchestrator

CVE-2026-93952 affects VeloCloud Orchestrator, the centralized management platform for VeloCloud SD-WAN infrastructure.

Arista says the issue is actively exploited.

The vulnerability carries a CVSS 3.1 score of 10.0 and can allow remote attackers to access privileged internal functionality and compromise the orchestrator and the data it manages.

This was not VeloCloud’s first exploited orchestrator vulnerability of 2026. CVE-2026-16812 had already been added to CISA KEV in July.

That recurrence is particularly significant.

Why Edge Infrastructure Is Attractive

The individual vulnerability classes differ substantially.

SQL injection.

Authentication bypass.

Memory corruption.

Input validation.

SSH privilege manipulation.

The common factor is not vulnerability type.

It is architectural position.

Internet Exposure

Edge systems often need to receive traffic from untrusted networks to perform their intended function.

A VPN gateway that cannot receive remote connections is not useful.

An email gateway that cannot receive external email cannot inspect it.

A reverse proxy that cannot receive HTTP traffic cannot proxy it.

This means exposure is often intentional rather than accidental.

High Privilege

Edge appliances frequently require elevated operating-system privileges and extensive network access.

Compromising one may therefore yield substantially more leverage than compromising an ordinary web application.

Cisco’s Secure Email Gateway vulnerability demonstrates the extreme version: attacker-controlled email can ultimately lead to command execution as root.

Trusted Network Position

A compromised edge appliance begins its post-exploitation life in an advantageous location.

It may already be permitted to communicate with:

• identity infrastructure;
• management networks;
• internal applications;
• authentication servers;
• DNS;
• logging infrastructure;
• other cluster members.

Firewall policy may trust those communications precisely because they originate from security infrastructure.

Credentials and Cryptographic Material

Security appliances often need secrets to interact with other systems.

Cisco explicitly warns that compromised Secure Email Gateway cluster members may expose SSH private keys used for inter-member authentication.

The general lesson is broader.

Whenever a security product integrates with another system, testers and defenders should ask:

What credential makes that integration work, and where is it stored?

Limited EDR Coverage

Traditional servers and workstations increasingly run endpoint detection products.

Network appliances often do not.

Proprietary operating systems, vendor restrictions and appliance architectures can make conventional EDR deployment impossible.

That means defenders may have excellent visibility before traffic reaches the edge and after it reaches endpoints—while having much poorer visibility into what happens inside the device connecting those environments.

Centralized Management

Management systems create another concentration of risk.

VeloCloud Orchestrator exists specifically to manage distributed edge infrastructure.

That means compromising the orchestrator can potentially be more valuable than attacking individual edge nodes one at a time.

Centralization improves administration.

It also centralizes trust.

A Different Offensive-Security Methodology

Traditional external penetration tests commonly begin with something like:

domains
→ IP addresses
→ ports
→ applications
→ vulnerabilities.

Edge-oriented testing should add another layer:

domains
→ IP addresses
→ services
→ infrastructure role
→ trust relationships
→ vulnerabilities
→ post-compromise value.

Knowing that TCP 443 is open is not enough.

What is behind it?

A marketing website and an identity-aware access proxy may expose the same port while presenting completely different strategic opportunities.

Passive reconnaissance, certificate inspection and safe service enumeration can help classify those systems before deeper testing begins.

The Post-Compromise Question

A vulnerability report frequently ends too early.

“Remote code execution achieved.”

For edge infrastructure, that is where the interesting security analysis begins.

The next questions should be:

What configuration is stored here?

What credentials exist here?

Which internal systems communicate with this device?

Which systems trust connections originating from it?

Can the appliance modify traffic?

Can it authenticate users?

Can it create tunnels?

Can it manage other appliances?

Can compromise survive a reboot or software upgrade?

Those questions turn vulnerability testing into adversary-path analysis.

Detection Has to Move Outside the Appliance

The Cisco Secure Email advisory highlights a fundamental incident-response problem: once attackers obtain root access, they may remove evidence from the compromised appliance.

This is why edge-device telemetry should be exported.

Useful sources include:

• firewall telemetry;
• NetFlow;
• DNS logs;
• authentication logs;
• SIEM ingestion;
• upstream proxy logs;
• configuration backups;
• administrative audit trails.

An appliance should not be the sole authority on whether the appliance itself has been compromised.

Patching Is Necessary—but Exposure Still Matters

Every vulnerability discussed here has vendor remediation.

Organizations should apply it.

But the recurring exploitation of edge infrastructure suggests another question:

Why can an attacker reach the vulnerable component at all?

Sometimes the answer is unavoidable.

SMTP gateways must receive SMTP.

VPN gateways must receive VPN traffic.

But management interfaces rarely need universal internet reachability.

MikroTik’s guidance following the RouterOS exploitation is straightforward: do not expose SSH management to untrusted networks; use restricted trusted access or VPN-based administration instead.

That principle generalizes well.

Expose the service the appliance exists to provide.

Restrict everything else.

Centralized Edge Management Deserves Special Attention

VeloCloud provides a particularly useful case study.

Arista disclosed CVE-2026-93952 on September 22 and confirmed active exploitation.

Only two months earlier, another VeloCloud Orchestrator vulnerability—CVE-2026-16812—had entered KEV following exploitation.

The lesson is not that one vendor is uniquely insecure.

It is that centralized management systems offer attackers excellent economics.

Compromise one management platform and you may obtain influence over infrastructure distributed across multiple sites.

That makes orchestrators, controllers and management planes high-priority assets during both offensive assessments and defensive hardening.

Security Appliances Are Applications

One conceptual mistake ties many of these incidents together.

Organizations often categorize devices such as firewalls, VPN concentrators and access gateways as “infrastructure.”

Attackers do not care about that organizational boundary.

To an attacker, they are software.

They have:

• parsers;
• APIs;
• authentication code;
• memory-management bugs;
• databases;
• web interfaces;
• credentials;
• operating systems.

Cisco’s email gateway had an SQL injection.

F5’s access gateway had a heap overflow.

Cisco ISE had an API authentication failure.

RouterOS had SSH state and privilege problems.

VeloCloud had input-validation failures.

These are application-security problems occurring inside infrastructure products.

What Red Teams Should Change

External attack-surface discovery should deliberately identify:

VPN concentrators, firewalls, load balancers, identity appliances, routers, SD-WAN controllers, secure email gateways and remote-management systems.

Finding them is only the first step.

The tester should map what each device trusts and controls.

A useful model is:

Internet
↓
Edge system
↓
Authentication / routing / inspection
↓
Credentials and configuration
↓
Trusted internal relationships
↓
Potential lateral movement

That model helps prioritize targets by strategic value instead of simply by CVSS score.

What Defenders Should Change

Edge infrastructure needs the same lifecycle discipline applied to endpoints and servers:

inventory it;

identify its owner;

record its software version;

monitor vendor advisories;

centralize its logs;

restrict its management interfaces;

back up its configuration;

patch it;

and maintain an incident-response procedure for rebuilding it.

Most importantly, know which appliances are internet-accessible before the next KEV entry appears.

Emergency vulnerability management becomes substantially easier when asset discovery has already happened.

Broader Security Lesson

The evidence does not show that endpoints have stopped mattering.

It shows that attackers have another valuable class of endpoint.

A firewall is a computer.

A router is a computer.

A VPN concentrator is a computer.

An identity appliance is a computer.

An SD-WAN orchestrator is a computer.

The difference is that these computers often possess unusually powerful network positions while receiving less endpoint-style monitoring.

That asymmetry is attractive.

And attackers appear to understand it.

Key Takeaways

• Multiple edge and security infrastructure vulnerabilities were confirmed exploited during September 2026.
• Cisco, F5, MikroTik, Check Point and VeloCloud all provide current case studies.
• The common factor is architectural position rather than vulnerability class.
• Edge systems combine exposure, privilege, credentials and network trust.
• Centralized management systems offer particularly attractive attacker economics.
• Offensive-security assessments should map trust relationships after discovering edge infrastructure.
• Defenders need external telemetry because a fully compromised appliance may no longer provide trustworthy local evidence.

References

• CISA — Four Known Exploited Vulnerabilities Added September 22, 2026. CISA KEV Alert
• Cisco — ISE Authentication Bypass. Cisco ISE Advisory
• Cisco — Secure Email Gateway SQL Injection. Cisco Secure Email Advisory
• F5 — BIG-IP APM CVE-2026-94127. F5 Advisory
• MikroTik — September 2026 Vulnerability. MikroTik Security Advisory
• CERT Polska — RouterOS Vulnerabilities Actively Exploited. CERT Polska Analysis
• Arista — Security Advisory 0183: CVE-2026-93952. Arista VeloCloud Advisory
• Canadian Centre for Cyber Security — Check Point Security Advisory AV26-902. Check Point Advisory Summary

Red Brixen Research Notes

Research Confidence: High
Confirmed Exploitation: Yes — across multiple case studies
Public PoC: Varies by vulnerability; exploit code was not required or reproduced
CISA KEV: Yes — multiple discussed vulnerabilities
Primary Sources Consulted: Cisco, F5, MikroTik, CERT Polska, Arista, CISA, Canadian Centre for Cyber Security
Last Verified: September 25, 2026