Look at what CISA added to the Known Exploited Vulnerabilities catalog across July 2026 and a pattern falls out immediately:

  • 14 July — four additions, including CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances
  • 16 July — three additions: CVE-2026-25089 and CVE-2026-39808, OS command injection in Fortinet FortiSandbox, plus CVE-2026-58644, deserialization of untrusted data in Microsoft SharePoint
  • 27 July — two additions: CVE-2025-68686, exposure of sensitive information in Fortinet FortiOS, and CVE-2026-16812, OS command injection in Arista VeloCloud Orchestrator On-Prem
  • 29 July — one addition: CVE-2026-20316, use of a hard-coded password in Cisco Secure Firewall Management Center

Not one endpoint application. Not one browser. Not one office productivity client, unless you count SharePoint — which in this context behaves less like a document tool and more like an internet-facing server that happens to store documents.

Everything else on that list is an appliance whose job is to be the boundary: a remote access gateway, a malware analysis sandbox, a firewall OS, an SD-WAN orchestrator, and a firewall management centre.

Why a Smart Office Site Cares About VPN Appliances

Because in a connected building, the edge appliance is doing a job nothing else can do.

Work through the devices in a typical office: cameras running vendor firmware you cannot audit, HVAC controllers speaking an unauthenticated protocol by design, badge readers on a decade-old platform, a video management server on an OS version pinned by its support matrix, conference room hardware nobody has logged into since installation, and a scattering of gateways bought to get legacy equipment onto a network cheaply.

Almost none of that can be secured through the device itself. There is no EDR agent for a door controller. There is no MFA on a BACnet controller. Many have no patch available and never will — a point that keeps recurring, from June’s end-of-life camera advisories to the 296,000-device Dysphoria population.

Which means the actual security control for most of a building’s connected estate is the network boundary and the appliance enforcing it. Segmentation, remote access control, and the policy engine that decides which flows are allowed. When that appliance is the thing being exploited, every downstream device it was compensating for is exposed at once.

The Failure Classes Are Embarrassingly Basic

Read the vulnerability types rather than the product names:

Hard-coded password (CVE-2026-20316, Cisco Secure FMC). A credential shipped in the product, identical across installations, that the customer cannot change. This is the same defect class that dominated CISA’s IoT advisories in June — and it landed here in the management console for enterprise firewalls. It is also the second serious credential issue in this product line in a matter of months, following the FMC flaw exploited alongside Interlock ransomware activity in May.

OS command injection (FortiSandbox, VeloCloud Orchestrator). User input reaching a shell without sanitisation. The same bug the Haiwell IoT gateway shipped in its ping utility. It appears in a cheap Chinese HMI gateway and in an enterprise SD-WAN orchestrator in the same month, because it is a property of how the code was written, not of how much the product cost.

Deserialization of untrusted data (SharePoint). Also the root cause of the C•CURE 9000 access control server flaw published a week later. When an application reconstructs objects from attacker-supplied bytes without constraining what types may be built, code execution follows.

Exposure of sensitive information (FortiOS). The quiet one. Not directly code execution — but exposed configuration, credentials or tokens are the input to the next stage, which is why these entries reach KEV.

There is no advanced tradecraft on this list. The reason these get exploited is not sophistication; it is reachability. These devices are internet-facing by design, running privileged code, holding credentials for everything behind them.

The Compounding Problem: Management Planes

Three of the six are not the enforcement device but the thing that manages enforcement devices: FortiSandbox, VeloCloud Orchestrator, Secure Firewall Management Center.

That is the same shape as the N-central RMM compromise, and it is not coincidence. A management console is strictly more valuable than the devices it manages, because it can reconfigure them, push policy, and read their state — and it does all of it through channels that are authorised and expected. An attacker who owns the firewall manager does not need to bypass the firewall. They can ask it to open.

For a building operator, the implication is a specific inventory task most organisations have never done: list every system that can change network policy or push configuration to a network device. In a mid-sized office that list is usually three to six systems. It is almost always shorter than people expect, and almost never written down.

What To Do

  1. Check your KEV exposure against these six, this week. If you run SonicWall SMA1000, FortiSandbox, FortiOS, VeloCloud Orchestrator On-Prem, Cisco Secure FMC, or on-premises SharePoint, these are confirmed exploited in the wild — not theoretical. Federal agencies have binding deadlines; the vulnerability does not care that you are not one.
  2. Subscribe to the KEV feed and route it somewhere a human reads. It is a free, machine-readable, high-signal list of what is actually being used against people. Very few smaller organisations consume it, and it is the single best-value input available.
  3. Enumerate your management planes and treat them as tier-zero. Every system that can push configuration to a network device gets MFA, restricted source addresses, its own patch SLA, and monitoring on administrative logins.
  4. Get management interfaces off the internet. A firewall management centre reachable from the public internet is a design decision, and one worth revisiting. Where remote administration is genuinely required, put it behind a separate authenticated path rather than exposing the console.
  5. Verify your segmentation still holds if one appliance falls. If a single compromised edge device puts an attacker on the same segment as the cameras, BMS controllers and access control server, your segmentation is a single point of failure. Internal boundaries matter for exactly this scenario.
  6. Treat repeated CVEs in one product line as a signal. Two serious credential issues in the same firewall management product within a few months is information about engineering practice, and it belongs in the renewal conversation.

The Read

July’s KEV additions describe how organisations are actually being broken into in 2026: through the appliances at the edge and the consoles above them, using vulnerability classes that have been well understood for twenty years.

For connected offices, that is both bad and clarifying. Bad, because the boundary devices carrying the security burden for everything unpatchable in the building are themselves the most-targeted software in the estate. Clarifying, because it tells you where to spend attention. You cannot patch the door controller. You can absolutely patch the firewall manager, take its web console off the internet, and make sure that when it does fail, it does not fail open onto the camera VLAN.