The edge keeps breaking: why perimeter CVEs outrun your pentest cadence

Look at where the serious intrusions of the last year actually started, and a pattern jumps out: not phishing, not a clever web-app bug, but the appliance sitting at the edge of the network — the VPN concentrator, the firewall, the secure file-transfer box. The exact devices meant to protect the perimeter have become the softest way through it.

Here’s the uncomfortable timeline, all of it real and all of it from roughly the last year.

The VPN and remote-access gateways

• Ivanti Connect Secure opened 2025 with CVE-2025-0282, an unauthenticated remote-code-execution flaw exploited in the wild (traced to December 2024) and added to CISA KEV on disclosure. Months later, CVE-2025-22457 — a bug initially dismissed as a mere denial-of-service — turned out to allow RCE and was being exploited before the fix landed.
• Citrix NetScaler gave us “CitrixBleed 2” (CVE-2025-5777): a single crafted request leaks memory, steals session tokens, and bypasses MFA. CISA added it to KEV in July 2025 with a 24-hour federal patch deadline; researchers counted tens of thousands of exposed instances.
• Cisco ASA/Firepower firewalls were hit by a pair of zero-days (CVE-2025-20333 and CVE-2025-20362) chained for full device takeover in the ArcaneDoor campaign — serious enough that CISA issued Emergency Directive ED 25-03 ordering agencies to act within 24 hours, and later warned that patching alone might not evict a firmware-persistent attacker.
• Palo Alto GlobalProtect added CVE-2026-0257, an authentication bypass added to KEV in May 2026 with exploitation observed within weeks — the latest in a long run of PAN-OS management-plane bypasses.
• Fortinet FortiGate saw authentication-bypass flaws (CVE-2025-59718 / CVE-2025-59719) exploited on internet-exposed devices, with KEV listing and a seven-day deadline.

The file-transfer appliances

Secure file-transfer software has become a ransomware crew’s favorite door. CrushFTP CVE-2025-54309 (auth bypass to admin) was exploited as a zero-day and added to KEV in July 2025; Cleo Harmony/VLTrader (CVE-2024-50623) was mass-exploited, with the first patch proving incomplete and a second flaw piled on. The through-line: these boxes are internet-facing by design, hold other people’s data, and get hit within days of a flaw surfacing.

And sometimes it’s the vendor

In October 2025, F5 disclosed that a nation-state actor had long-term access to its product-development environment and exfiltrated BIG-IP source code and information on undisclosed vulnerabilities — prompting CISA’s Emergency Directive ED 26-01. You can’t pentest your way around your vendor being compromised. You can know exactly which BIG-IP devices you have exposed when the directive drops.

Why this breaks the annual-pentest model

Notice the cadence. These weren’t spread out — they landed roughly monthly, each one unauthenticated, each one mass-exploited within hours to days, several with 24-hour to 7-day federal patch deadlines. Now line that up against a pentest cadence: you test your perimeter once a year, maybe once a quarter. The CitrixBleed that owns your gateway in July doesn’t care that your March pentest came back clean.

The defense isn’t a better annual pentest. It’s continuous awareness of your own edge: knowing, at any moment, exactly which VPNs, firewalls, and file-transfer appliances you expose and what versions they run — so that the day a CVE-2025-whatever hits KEV, you can answer “are we affected, and where?” in minutes instead of launching a fire drill to find your own assets first.

That’s the entire premise of continuous external monitoring, and of ProbeIQ: discover and track your internet-facing surface on a schedule, fingerprint what’s running, and tell you what changed — so a new edge CVE is a quick lookup, not a weekend. Your perimeter changes faster than your pentest cadence. Your monitoring should too. Start watching yours.