The last two weeks have been rough for anything that lets people connect in from outside the office. CISA added a ConnectWise ScreenConnect flaw to its actively-exploited list on September 11 (CVE-2026-84869, improper privilege management and missing authorization). The Dutch national cyber agency says exploitation of two critical Check Point VPN bugs is imminent. Cisco Talos is watching attackers, including a Qilin ransomware affiliate, break into Secure Firewall Management Center boxes right now.
Those are four different vendors, one pattern. The stuff at the edge of your network is the target, because it is reachable from anywhere and it rarely gets patched on a schedule. Here is the order I would work through it.
1. Write down what is actually exposed to the internet
Not a scan report. A list, on one page: your firewall and its management interface, your VPN gateway, any remote access agent your IT provider uses, your remote desktop setup, your NAS, your cameras. If you cannot name every device with a public IP address, that is the real finding, and everything below depends on fixing it first.
2. Patch your remote support tool this week
ScreenConnect is the software a lot of IT companies use to pop into your computer and fix things. That is exactly why attackers want it: one compromise, access to every machine it touches. If you run it self-hosted, update the server now. If your IT provider runs it, email them today and ask two things: what version are you on, and have you checked for unauthorized accounts and sessions. A provider who cannot answer that in an hour is telling you something.
3. Check Point VPN: LivePatch Take 24 or the jumbo hotfix
The two flaws (CVE-2026-85102 and CVE-2026-85103) let a remote attacker run code on a Security Gateway by abusing how certificates get parsed during the VPN handshake. Affected: R81.20, R82, R82.10, R81.10.x, R82.00.x, plus end-of-support builds R80 through R81.10. Fixes are in LivePatch Take 24 and in the jumbo hotfix accumulators (R82.10 Take 44, R82 Take 126, R81.20 Take 166). R82.20 is not affected. If you use site-to-site VPN, also restrict those rules to specific trusted IP addresses instead of the world.
4. Cisco Secure FMC: hotfix now, full release next week
CVE-2026-20079 is a 10.0. Unauthenticated attacker, straight to root on the box that manages your firewalls. Talos found web shells, credential theft, tunneling tools and a ransomware operator building a target list of machines to encrypt. Apply the released hotfixes for both CVE-2026-20079 and CVE-2026-20316 today. Cisco’s broader hardening release lands the week of September 14. Do not wait for it.
5. SonicWall SMA1000 owners: models 6210, 7210, 8200v
Two flaws disclosed September 1, both confirmed exploited in the wild, one of them a CVSS 10.0 that needs no login at all (Sophos has the details). Upgrade the appliance. We wrote about ransomware gangs hitting SonicWall remote access earlier this year, and the pattern has not changed: these boxes get popped, then the encryption starts a few days later.
6. Assume the patch might be late, and go look
This is the step everybody skips. If a device was exposed and vulnerable for a week, patching it does not evict anyone who already got in. Check for accounts you did not create, scheduled tasks you did not write, new admin sessions, and outbound connections from an appliance that should never initiate them. Pull the logs before they roll over. That kind of hunting is what managed detection (what we run for clients) exists to do, because nobody’s office manager is reading firewall logs on a Saturday.
7. Then get to Windows
Microsoft shipped patches for nearly 1,000 flaws on September 8, its biggest batch ever, including two privilege-escalation bugs already being exploited (Krebs has the breakdown). You cannot test a thousand patches. You do not have to. Prioritize the two exploited zero-days, the DNS Server bug that an attacker can hit with a single crafted packet, and the critical Windows Shell flaw that needs no user interaction. Then let the rest roll out on your normal schedule.
What we handle
For clients on our managed IT plans, items 1, 6 and 7 are ongoing work, not a project: we keep the exposed-device inventory current, patch on a schedule with a rollback plan, and watch for the post-compromise behavior that shows up after an edge device gets hit. Items 2 through 5 are the kind of thing we do the same week they break.
If you are not sure who is patching your firewall, or whether anyone is, that is worth thirty minutes of attention before it becomes worth thirty thousand dollars. Book a free 15-minute consult and we will go through your exposed list with you.