Patch internet facing remote access gateways first because they are reachable by anyone, they sit in front of everything else, and a flaw in one can bypass your other controls. Keep an inventory with versions, subscribe to vendor advisories, and check each new advisory against the CISA known exploited list.
Why edge devices rank higher than internal servers
An internal server needs an attacker to get inside first. A VPN or remote access gateway is already at the boundary and answers connections from the internet. If it has a flaw that allows access without logging in, nothing else stands between the attacker and the network.
The gateway also holds secrets. It often stores or validates credentials, certificates and session data, so compromise tends to be broad.
Use the KEV list as an input
CISA maintains the Known Exploited Vulnerabilities catalog, a list of vulnerabilities seen exploited in the wild. CISA says organizations should use it as an input to their vulnerability management prioritization framework. Each entry carries a due date and points to vendor mitigations.
Treat a gateway product appearing on that list as a drop everything signal. Treat a gateway CVE that is not on the list as important, but ranked by exposure and exploit information.
Build the inventory you need
You cannot patch what you do not know exists. Record for each gateway:
- Product, model and software version.
- Where it is reachable from, and on which ports.
- Owner and a backup owner.
- Management interface exposure, which should not be public.
- Support status of the version, since end of life devices need replacing.
Forgotten gateways at old offices or acquired companies are the usual surprise. Asset discovery that scans your own address ranges finds them.
When you cannot patch today
- Read the vendor advisory for interim mitigations such as disabling a feature.
- Restrict management access to a small set of addresses.
- Increase logging and review it daily.
- Consider whether to take the service offline if exploitation is active and no mitigation exists.
- Record the exception with an owner and a date.
After patching
A patch closes the hole but does not remove an attacker who entered earlier. When an advisory reports exploitation, also review logs from before the patch, rotate credentials the device handled, and check for new local accounts and unexpected configuration changes. Vendors often publish indicators; use them.
For tracking the whole process, see the demo below.
Click through it at your own pace, or open it full screen.
How Safeguard can help
Safeguard provides asset discovery and dependency and SBOM scanning, and you can run a free scan at https://gold.safeguard.sh/scan to see what is exposed in your software. Network appliances still need their vendor's own patch process.
Quick check
Is a gateway behind a cloud service still edge?
If it accepts connections from the internet, treat it as edge. Cloud hosting changes who runs the hardware, not the exposure.
Sources
Last reviewed: 19 October 2026.
