Firewall and VPN patching: what to fix first

Triage order

Rank every device by exposure first, then by whether an exploit is known. Work down the list, and never let a lower tier delay a higher one. Management consoles come first: one compromise there hands over every device it manages.

Tiers 2 to 5 match the Essential Eight Maturity Level One patching rules for internet-facing and other network devices. Tier 1 is stricter on purpose. “Known-exploited” means listed in the CISA Known Exploited Vulnerabilities catalog or flagged as exploited in the vendor advisory. Not sure whether a device is past end of support? Check it here.

Per-device checklist

Run this for every firewall, VPN gateway and management console.

• Record vendor, model, software version and support end date
• Check whether the web UI, central manager or VPN portal is reachable from the internet. Test from outside, not by reading the config
• Match the version against the vendor advisories in the current alerts below
• Take a config backup and store it off the device
• Run the compromise checks below before patching, so evidence isn't lost in the upgrade
• Schedule the upgrade to the vendor's fixed release; for HA pairs, upgrade the standby first
• After the upgrade, confirm the running version and that VPN, routing and policies still work
• Rotate admin passwords, API keys and VPN pre-shared keys if the device was exposed while vulnerable
• Log the date, version and who did it in the change record

If you can't patch today

These cut exposure until the fix lands. They do not replace the patch.

• Remove internet access to management interfaces; allow them only from a named admin IP list or over VPN
• Turn off features you don't use, such as a clientless SSL VPN portal or web-based management on the WAN side
• Apply the vendor's published workaround or threat-prevention signature for the specific CVE, where one exists
• Require MFA on VPN and admin logins. It won't stop an authentication bypass, but it blocks credential reuse
• Geo-block VPN logins from countries you don't operate in
• Turn up logging on the device and forward it off-box, so an attack attempt is visible

Check for compromise

Patching closes the hole but does not remove an attacker who is already in. On any device that was exposed while vulnerable:

• Run the vendor's integrity or indicator-of-compromise check where one is published for the CVE
• Look for admin accounts, API keys or VPN users nobody recognises
• Compare the running config against the last known-good backup
• Review logs for logins from unfamiliar IPs and for the request patterns named in the advisory
• Check for unexpected outbound connections from the device itself

If you find signs of compromise, treat the device as untrusted. Rebuild it from a clean image, rotate every credential it held, and start your incident response. In Australia, report it to ASD through ReportCyber, and assess whether the Notifiable Data Breaches scheme applies.

Sources

• cisco-sa-onprem-fmc-authbypass-5JPp45V2: Secure FMC authentication bypass — Cisco
• cisco-sa-sdwan-webauth-xr8beuuU: Catalyst SD-WAN Manager API authentication bypass — Cisco
• CTX696939: NetScaler ADC and Gateway bulletin for CVE-2026-19489 and CVE-2026-19490 — Citrix
• FG-IR-25-084: FortiOS cw_acd heap overflow — Fortinet PSIRT
• FG-IR-26-175: FortiMail path traversal — Fortinet PSIRT
• CVE-2025-25249 — NVD
• CVE-2026-104286 — NVD
• CISA flags exploited Cisco, Citrix, Fortinet flaws — The Hacker News
• CISA adds exploited Cisco Catalyst SD-WAN Manager auth bypass to KEV — The Hacker News
• Check Point warns of management server zero-day — The Hacker News
• Critical vulnerability in Palo Alto GlobalProtect (CVE-2026-0257) — Beazley Security
• CISA adds Fortinet FortiMail 0-day to KEV — Cyber Security News
• Essential Eight maturity model — ASD
• Known Exploited Vulnerabilities Catalog — CISA

General information only, not advice for your specific environment. Product names belong to their vendors. Spotted something out of date? Tell us and we will fix it.