The short version
Remote-access appliances (often called SSL VPN or secure access gateways) give remote employees access to company systems. In 2026 CISA has added four vulnerabilities in one widely used line of these appliances to its Known Exploited Vulnerabilities catalog, and it marks two of them as known to be used in ransomware campaigns. If your business uses a remote-access appliance, confirm your make, model and patch level now.
The four exploited flaws
- CVE-2026-15409 (added to KEV July 14, 2026): server-side request forgery, remote and unauthenticated. Ransomware use: known, per CISA.
- CVE-2026-15410 (added July 14, 2026): code injection that can let an authenticated admin run OS commands. Ransomware use: known.
- CVE-2026-83548 (added September 2, 2026): server-side request forgery giving remote, unauthenticated access to sensitive functions. Ransomware use: unknown.
- CVE-2026-83549 (added September 2, 2026): OS command injection allowing remote code execution by an authenticated admin. Ransomware use: unknown.
You can look up each CVE, and the vendor advisory linked from it, in the CISA KEV catalog or on NVD.
Patch twice if you patched in July
The fix released for the July pair is itself affected by the September flaws, so anyone who patched in July has to patch again. The vendor says these issues don’t affect the SSL-VPN feature on its firewalls or its smaller appliance series. If indicators of compromise are found, the vendor advises re-imaging or re-deploying the appliance, changing all user and admin passwords and resetting one-time-password tokens.
Why remote-access appliances are a top target
A remote-access gateway sits on the internet by design and leads straight into your network. Pairing an unauthenticated flaw with an admin-level command injection is a common route to full control of a device, and the vendor’s advisories describe exactly that pairing.
What to do now
- Confirm what remote-access appliance you have, including the exact model.
- Check the CVEs above against your model and upgrade to the latest fixed firmware, which covers all four.
- Restrict the management interface to trusted IPs; never expose it to the internet.
- Reset admin and local user passwords if the appliance ran vulnerable firmware while internet-facing, and require MFA.
- Review logs for unfamiliar admin sessions or configuration changes; if you see any, treat it as an incident and involve your IT or security provider.
- If the appliance is end-of-life or unmanaged, plan a replacement.
How Queen City IT Professionals can help
If you’re not sure which internet-facing devices you have, start with a free IT & security assessment. Learn more on our cybersecurity page and our managed IT page.
Frequently asked questions
Which remote-access appliances are affected?
These four CVEs affect one vendor’s line of enterprise remote-access appliances, according to CISA’s KEV catalog. Check the vendor advisory linked from each CVE entry to see whether your model is listed and which firmware fixes it.
Are these flaws used in ransomware attacks?
CISA marks CVE-2026-15409 and CVE-2026-15410 as having known use in ransomware campaigns. For CVE-2026-83548 and CVE-2026-83549, ransomware use is listed as unknown.
Do I need to do anything besides patching?
Yes. Restrict management access, rotate passwords, require MFA and check logs for signs of earlier compromise, since patching doesn’t remove an attacker who already got in.
We use a firewall’s built-in VPN, not a separate appliance. Are we affected?
The vendor says these specific CVEs don’t affect the SSL-VPN on its firewalls. Your firewall still needs current firmware, so confirm what you have and keep it patched.