Partly. A VPN narrows who can connect to a service, so it usually lowers exposure compared with a public address. But the VPN gateway itself faces the internet, and anyone with valid VPN credentials is inside the boundary. Label such services as internal with a note, not as isolated.
Two things to separate
There are two exposures to count. The first is the service. The second is the VPN or access gateway in front of it.
The service is no longer reachable from random internet addresses, which is a real improvement. The gateway is now a public service of its own, and its own vulnerabilities matter a great deal.
How to label it
| Setup | Suggested exposure label |
|---|---|
| Service on a public address | Public |
| Public login page in front of the service | Authenticated public |
| Service reachable only over a VPN | Internal |
| Service reachable only from named hosts with network rules | Isolated |
| The VPN or gateway itself | Public |
The last row is the one teams forget. A flaw in the access gateway is a flaw on a public asset, and it belongs at the top of your exposure scale.
Why VPN is not isolation
- Credentials. A phished or stolen VPN login gives access.
- Endpoints. A compromised laptop connected to VPN sits inside the boundary.
- Wide access. Many VPNs give a connected user broad network reach, not just the one service they need.
- Shared accounts. Shared logins make it hard to know who is connected.
The CVSS v4.0 specification lets consumers adjust attack vector in the Modified Base metrics. If a service is not reachable from the internet, you may justify a narrower attack vector. The justification should state how access is limited, and the VPN claim should be checked.
Verifying it
- Scan the service from outside your network and confirm it does not answer.
- List who has VPN access and how access is granted and removed.
- Check whether a connected user can reach only this service or the whole network.
- Record the date of the test.
Zero trust style access
Access gateways that check identity and device posture per request can narrow reach more than a flat VPN. They still have a public front door, and they still depend on identity being protected. The same rule applies: label the gateway as public and the service behind it by how narrow access really is.
What this means for priority
A service behind a VPN can move down one tier if the access path is verified and the flaw needs network access. It should not move down at all if the flaw is known to be exploited, if the service holds credentials that open other systems, or if every employee with VPN can reach it.
CISA's Known Exploited Vulnerabilities Catalog is a place to check for exploited flaws in the gateway products you run. A listed flaw there deserves quick attention.
Quick check
Should the VPN gateway be labelled public?
Yes. It is reachable from the internet, and its flaws are often urgent.
Can a VPN justify a lower attack vector in CVSS?
Possibly, if you verify that access is limited. Record how you checked.
Sources
Last reviewed: 19 October 2026.
