Edge appliance exploitation is converging across state and criminal actors

At a glance

What this is: NHI Mgmt Group's analysis, drawing on SentinelOne's research: Edge appliance exploitation is converging across both state and criminal actors, with the shared vendor attack surface proving more important than any single CVE.

Why it matters: It matters because security teams cannot treat edge-device risk as a one-actor problem; IAM, PAM, and NHI controls must assume the same appliance can be used by multiple threat classes and for follow-on credential abuse.

Context

Edge appliances sit on a trust boundary, so compromise often gives attackers a privileged foothold before endpoint controls can see the activity. That makes exposure management, patch timing, and privilege containment part of the same governance problem, especially when the affected systems hold credentials or management access that can be reused elsewhere.

The article’s core claim is not that one CVE or one threat actor dominates. It is that independent telemetry and incident-response data converge on the same vendor surfaces, which means defenders need to think in terms of exposed edge platforms, credential-bearing management planes, and the persistence of risk across successive vulnerability cycles.

Key questions

Q: What breaks when a perimeter appliance is exploited before patching is complete?

A: When an internet-facing gateway is exploited before patching finishes, the trust boundary itself becomes the failure point. Attackers can use the device as an entry path into remote access, session handling, and downstream authentication flows, which means the compromise can outlive the initial vulnerability and affect multiple control layers.

Q: Why do state and criminal actors converge on the same edge devices?

A: Because the device role, not the attacker motive, creates the opportunity. Internet-facing appliances concentrate remote access, management trust, and often privileged credentials into a small number of products. That makes the same vendor surface valuable to espionage groups, ransomware crews, and other criminals alike, even when they exploit different CVEs or operate on different timelines.

Q: How do security teams know if their edge device exposure is becoming a resilience problem?

A: Security teams know edge device exposure is becoming a resilience problem when public-facing services are enabled without a documented business need, when recursion or similar amplifying functions are open to the internet, and when device inventories cannot quickly answer who owns the exposure. Those conditions indicate attack capacity can be formed from your own infrastructure.

Q: Should organisations prioritise edge appliances over other vulnerabilities?

A: When the appliance sits at the trust boundary and can expose credentials or remote management, yes. The priority is not based only on CVSS. It is based on blast radius, public reachability, and whether compromise would expose identity material or internal access. That is why internet-facing edge systems often deserve a separate, faster remediation lane.

Technical breakdown

Why edge appliances keep becoming shared entry points

Edge appliances combine remote access, management functions, and network trust into a small number of high-value products. When those products expose a CVE, the same flaw can be used by very different adversaries, from espionage groups to ransomware operators, because the exploit path is defined by the device position rather than the attacker’s motive. The article’s key technical point is that overlap at the vendor level can be high even when overlap at the individual CVE level is low. That means the real issue is architectural concentration: many organisations depend on the same perimeter technologies, so exploitation patterns repeat across those shared surfaces.

Practical implication: treat edge appliances as a concentrated attack surface and track exposure by vendor family, not just by individual vulnerability.

Why remediation lags on perimeter devices

Perimeter devices are operationally hard to patch. They often lack endpoint agents, may require firmware-level maintenance, and can trigger downtime for broad parts of the environment when updated. That creates a structural gap between disclosure and remediation, especially for high-priority vulnerabilities. The article shows that patching delays are not random inefficiency but a consequence of change control, dependency load, and device role. For identity and access teams, this matters because management-plane exposure can preserve standing access paths even after the original vulnerability is known. A delayed patch is not only a device issue; it extends the lifetime of any credentials or sessions the device can still broker.

Practical implication: align patch SLAs for edge appliances with business downtime windows and management-plane credential reviews.

How stolen appliance access turns into broader compromise

Once attackers reach an appliance management plane, they can often create accounts, export configuration, or recover embedded credentials. That is where edge compromise intersects directly with identity governance. The appliance may not be the final target; it becomes a credential reservoir and a route into directories, internal hosts, or remote administration tools. In practical terms, the device’s access scope is part of the identity boundary. If configuration exports contain bind accounts, SSH keys, or other secrets, the compromise expands beyond infrastructure into IAM and NHI risk. This is why appliances need to be governed as privileged identity brokers, not just network devices.

Practical implication: inventory and protect appliance-stored secrets with the same discipline you apply to privileged human and non-human identities.

Threat narrative

Attacker objective: The objective is to turn a perimeter device into durable internal access and reusable credentials that support follow-on compromise.

1. Entry occurs through exposed edge appliances that are reachable from the internet and contain exploitable CVEs.
2. Credential access follows when attackers obtain management-plane access, export configurations, or recover stored credentials from the device.
3. Escalation happens as stolen appliance trust is used to create accounts, access internal systems, or move laterally inside the environment.
4. Impact is persistent internal access across organisations, with the same vendor surfaces reused by both state and criminal actors.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Edge appliance exploitation is now a shared governance problem, not a niche vulnerability problem. The article’s strongest finding is the 79% vendor-level convergence across independent datasets, which means the control failure sits in exposure concentration rather than in any single CVE. Security teams should read that as a signal that perimeter-device governance has to be continuous, inventory-led, and attack-surface aware. The practitioner conclusion is straightforward: manage the vendor surface as a standing risk domain.

Credential-bearing appliances create a hidden identity boundary. Once a firewall, VPN gateway, or remote access appliance stores bind accounts, SSH keys, or management credentials, compromise moves from network security into identity security. That is the part many programmes miss. The security problem is not only unauthorised access to the device; it is the appliance acting as an identity broker with embedded trust. Practitioners need to treat appliance-held secrets as privileged assets with explicit ownership and lifecycle control.

Serial exploitation shows that patching alone does not end exposure. The article’s vendor-level recurrence pattern, especially on Ivanti product lines, shows that attack surfaces persist across successive CVEs and attacker classes. That tells practitioners to re-evaluate whether their current edge strategy assumes single-event remediation when the reality is repeated exploitation of the same product family. The practitioner conclusion is to reduce exposed functionality, not only close individual CVEs.

Multi-nexus exploitation changes how threat prioritisation should work. When the same vulnerability is used by state actors and ransomware groups, attribution no longer tells defenders which control set to apply. The control question becomes broader: can the environment withstand both espionage-grade and financially motivated abuse of the same edge system? That is a governance issue for SOC, IAM, and infrastructure teams together. The practitioner conclusion is to build response playbooks around shared exploitability, not actor stereotypes.

What this signals

Vendor-level convergence should change how programmes score exposure. A control model that tracks only individual CVEs will miss the fact that attackers are repeatedly arriving at the same product families through different paths. For practitioners, the useful unit of analysis is the exposed appliance estate, because that is where patch delay, management-plane privilege, and credential reuse intersect.

Edge devices need identity governance, not just network hygiene. When configuration exports, bind accounts, or SSH keys live on the appliance, the device is participating in privileged identity lifecycle management. That means offboarding, rotation, and ownership controls need to extend to the management plane, not stop at the firewall rule set.

Converged exploitation means actor attribution should not drive control design. The same surface can be used by nation-state, ransomware, or other criminal operators, so the defensive programme has to assume shared exploitability. The right response is to reduce exposed functionality, narrow administrative access, and keep appliance-held secrets out of persistent trust chains.

For practitioners

• Reduce exposed edge functionality Disable unused services, interfaces, and modules on VPN gateways, firewalls, and remote access appliances so the exploitable surface is smaller before the next CVE lands.
• Treat appliance-stored secrets as privileged assets Inventory bind accounts, SSH keys, API tokens, and configuration exports held on edge devices, then assign ownership and rotation rules just as you would for other privileged credentials.
• Shorten remediation windows for high-priority edge CVEs Set a separate SLA for internet-facing appliances and enforce exception handling when business change controls would otherwise leave them exposed for months.
• Review management-plane access paths Restrict who can administer edge appliances, log all administrative actions, and verify that stored credentials cannot be reused to reach directory services or internal systems.

Key takeaways

• Edge appliance exploitation is best understood as a vendor-surface problem, because different actors repeatedly target the same perimeter products even when the CVEs differ.
• Patch delay on internet-facing appliances is a structural risk factor, especially when the device can hold credentials or mediate internal trust.
• Security teams should manage edge systems as privileged identity brokers and reduce exposed functionality, not rely on CVE-by-CVE remediation alone.

Key terms

• Edge Appliance Estate: The collection of firewalls, VPNs, SD-WAN devices, and similar systems that sit at the network boundary and must be maintained directly by the organisation. These systems often combine security enforcement, traffic handling, and lifecycle management, which makes patching them unusually disruptive.
• Management Plane: The administrative layer used to configure, govern, and enforce behaviour across many endpoints or services. A management plane is not the workload itself. It is the control layer above it, which makes it especially sensitive to privileged misuse and delegated automation.
• Identity Attack Surface: Identity attack surface is the total set of accounts, tokens, login endpoints, trust paths, and supporting systems that can be probed for access. For password spraying, the risk grows with every externally reachable authentication path and every dormant or weakly protected identity.
• Multi-nexus Attribution: A situation where the same vulnerability is exploited by actors from more than one threat nexus, such as state-sponsored groups and ransomware operators. It shows that exploitability, not actor type, is often the more durable predictor of risk.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps identity and security practitioners connect privileged access, credential lifecycle, and operational control.