Edge Devices Are the New Front Door: Lessons From October’s Zero-Days

In the first days of October 2026, two critical flaws in security and network appliances were confirmed as exploited: CVE-2026-104286 in Fortinet FortiMail and CVE-2026-76504 in Cisco Catalyst SD-WAN Manager. Both are rated CVSS 9.8. Both need no credentials. And in both cases attackers were active before many teams had a fix to install.

This is not a coincidence. Devices at the edge of the network have become one of the most reliable ways in.

Why attackers favour edge devices

Email gateways, VPNs, firewalls and SD-WAN controllers share a few traits that make them attractive:

• They face the internet. Their management or service interfaces are often reachable from outside.
• They are trusted. They sit in privileged positions: an email gateway sees every message, an SD-WAN manager controls how traffic flows between sites.
• They are hard to watch. Most run closed operating systems. You usually cannot install an EDR agent on them, so the endpoint telemetry a SOC relies on is missing.
• They are slow to patch. Updating a gateway or controller often means a maintenance window, and the fix may not exist yet.

The FortiMail case shows what this looks like. According to indicators published by Fortinet, attackers implanted persistent code and changed mail archiving so that copies of messages went to infrastructure they controlled. Nothing about that looks like malware on a laptop. It looks like a configuration change.

What to watch instead

If you cannot put an agent on the device, watch what it does and how it is managed.

Configuration changes

Send appliance audit logs to your SIEM and alert on changes to sensitive settings: archiving and forwarding rules on mail gateways, routing and policy changes on SD-WAN, new administrator accounts anywhere. Changes made outside a planned window, or from an unusual source address, deserve a closer look.

Management plane access

Management interfaces should not be reachable from the internet. Where they are, log every login and API call, and treat successful administrative access from an unknown address as an incident until proven otherwise. The Cisco flaw is an authentication bypass in the management API, so failed logins alone will not reveal it.

Outbound traffic from the appliance itself

An email gateway that starts sending data to a new external destination, or a controller that opens connections it never made before, is a strong signal. These flows are visible in firewall and NetFlow data even when the appliance itself is opaque.

Known exploited vulnerabilities

Track your appliance inventory against CISA's Known Exploited Vulnerabilities catalogue and vendor advisories. When a device you run appears there, switch from routine patching to incident response: apply the workaround, then hunt for signs of compromise from before the disclosure.

Where AI triage helps

Each of these signals is noisy on its own. Administrators change configurations every day, and appliances talk to many destinations. The value comes from correlation: a configuration change, from an unusual address, shortly after an exploit was published, on a device that is in the KEV catalogue.

That is the kind of multi-step reasoning Claire Security's analyst simulation loop is built for. It gathers the surrounding evidence for an alert and passes analysts a verdict with the reasoning attached, rather than another line in a queue. See how we measured its effect.

A short checklist

• Inventory every internet-facing appliance and who owns it.
• Remove internet access to management interfaces wherever possible.
• Forward appliance audit and configuration logs to your SIEM.
• Alert on sensitive configuration changes and new admin accounts.
• Watch outbound connections from the appliances themselves.
• Treat a KEV listing for a device you run as the start of a hunt, not only a patch ticket.