Patched is not clean: repeat exploitation, compromise and end-of-life risk in edge devices

The 196 edge entries fall into 69 product families. 38 families have more than one entry, and 31 were exploited in more than one wave. Those 31 families account for 148 entries, or 75.5% of all exploited edge vulnerabilities in the period. The median gap between waves was 216 days: roughly two waves a year for the most affected products.

The longest histories belong to the most widely deployed remote-access products. Citrix NetScaler had 13 entries in 7 waves between July 2023 and October 2026. Cisco ASA and Firepower Threat Defense had 10 in 7, FortiOS and FortiProxy 7 in 7, and PAN-OS 9 in 6. Cisco SD-WAN entered the catalogue only in February 2026 and already has 9 entries in 3 waves.

Repeat exploitation partly reflects a large installed base and close attention from researchers and attackers, and we do not suggest that these products are less secure than their competitors. For an owner, the practical point is different: a product line exploited once is likely to be exploited again within a year, so the next emergency should be planned for rather than treated as a surprise.

CISA records known use in ransomware campaigns for 42 of the 196 edge entries (21.4%). Almost all of them, 40, are in families exploited in more than one wave. That is 27.0% of entries in repeatedly exploited families, against 4.2% (2 of 48) in families exploited only once.

One explanation is that ransomware groups invest in a small number of products they know are widely deployed and reliably exploitable, and return to them as new flaws appear. Another is that a product that has drawn attention once is more likely to have a later ransomware link investigated and reported. The data cannot separate the two, which is why we rate this finding moderate confidence.

Either way, the result points to the same priority: internet-facing products with a history of repeat exploitation deserve the fastest response and the closest monitoring.

Most KEV entries ask organisations to apply the vendor’s fix. A small number say more. We found 16 edge entries (8.2%) where CISA told organisations to look for compromise: to “check for signs of potential compromise”, to carry out hunt activities, or to follow an emergency directive with hunt instructions. The figure for all other entries was 6 of 717 (0.8%). Edge devices make up 21.5% of the catalogue, but 18 of the 29 entries (62.1%) that carry either a compromise check or CISA’s own mitigation instructions.

This guidance is becoming more common. It appeared on 2 edge entries in 2023 (the Cisco IOS XE web interface), none in 2024, 7 in 2025 and 9 in 2026 to 10 November. Six of the 2026 entries concern Cisco SD-WAN, under CISA Emergency Directive 26-03 and its hunt and hardening guidance.

A wider change is under way as well. From 11 June 2026 every new KEV entry, in every category, refers to CISA’s “Forensics Triage Requirements” under BOD 26-04, so the overall expectation now goes beyond patching. Within that, CISA marks 68.6% of edge entries added since that date (35 of 51) for forensic triage, against 61.3% of other entries (68 of 111). The gap is small and rests on few entries, so we place weight on the entry-specific guidance above rather than on the flag.

CISA’s growing emphasis on compromise checks follows a series of cases in which attackers kept access to edge devices after the flaw they used had been fixed. The five below each have a public primary source. Together they cover the products behind four of the eight largest families in this report.

The mechanisms differ: stolen session tokens that stay valid (Citrix), files planted where an upgrade does not remove them (Fortinet), integrity tools that can be deceived and implants that survive a factory reset (Ivanti), rootkits in the boot process (SonicWall), and changes to read-only memory that survive reboots and upgrades (Cisco). The lesson is the same in each case. Applying the fix stops new intrusions through that flaw. It does not prove that an earlier intrusion has ended.

These cases show a mechanism, not how often it happens. They do show that the assumption behind many remediation processes, that a patched and rebooted device is back to a known good state, cannot be relied on for edge devices without a separate check.

For 21 edge entries (10.7%), the catalogue says the affected product is, or could be, end-of-life. That is twice the rate for other products (5.0%). In 11 of the 21 the statement is definite; in the rest CISA uses its hedged wording that the product “could be” end-of-life. For these devices the only fix is replacement.

Almost all of this risk is in consumer and small-office equipment. 14 of the 22 consumer and small-office edge entries (63.6%) concern end-of-life products, mainly routers from D-Link (6), TP-Link (4), Zyxel (3) and ASUS (1). Only 7 of 174 enterprise entries (4.0%) do, four of them Ivanti Cloud Services Appliance version 4.6. Six of the 21 vulnerabilities were more than three years old when CISA added them, the oldest from 2014.

Such devices are rarely in a central inventory, yet they often connect remote staff, branch offices and small suppliers to corporate systems. An organisation that cannot see them cannot replace them.

Two common claims about edge devices are not supported by this data. The first is that edge flaws are unusually likely to need no login. Where the KEV description says either way, 79.7% of edge entries and 78.4% of other entries need no authentication, which is no meaningful difference. The description is silent for 73 edge entries (37.2%), so this could change with manual coding from vendor advisories.

The second is that edge intrusions mostly use chains of vulnerabilities. 67 edge entries (34.2%) were added on the same day as another entry from the same vendor, in 31 groups, which is consistent with chained exploitation or one campaign using several flaws. However, only 12 descriptions (6.1%) say that a flaw is chained, close to the 4.3% for other entries. Same-day additions can also reflect CISA’s working pattern, so we treat them as context rather than evidence.

Only 27 edge descriptions (13.8%) say the flaw is reached through a management or administrative interface. This is a lower bound, because many descriptions do not say which interface is affected.