Remote Access Without an Open Door: Moving an Office Off the VPN

Briefing

Between October 13 and October 16, 2026, CISA added remote access and perimeter products from Ivanti, Palo Alto Networks, Fortinet and BeyondTrust to its Known Exploited Vulnerabilities catalog. The Ivanti Connect Secure flaw (CVE-2026-104935) was exploited as a zero-day to run commands without authentication. CISA told organizations that suspect compromise to factory reset the appliance and rotate every password, certificate and key it handled.

We have watched this pattern since the days of PBX maintenance modems and dial-in access lines. Any service that waits for inbound connections from anywhere eventually gets found. The VPN concentrator is the modern version of that dial-in port: always listening, and once you are through it, you are on the network rather than in a single application.

NIST SP 800-207 and CISA's Zero Trust Maturity Model describe the alternative. Access is granted per user, per device and per application, and network location earns nothing by itself. In practice, zero-trust network access (ZTNA) uses a connector inside your network that dials out to a broker, so there is no inbound port on the firewall to probe. CISA and partner agencies recommended this direction in their 2024 joint guide on modern network access.

What to do

1. List what staff actually reach remotely. In most offices we wire, it is a short list: the line-of-business application, a file share, accounting, and one or two remote desktops.
2. Fix identity before you move anything. One named account per person, multi-factor authentication on email and admin accounts, and same-day disablement when someone leaves.
3. Decide which devices qualify. Managed laptops with current patches reach sensitive systems. Personal devices get webmail or nothing.
4. Publish one application at a time through ZTNA and run it next to the VPN until users are moved.
5. Close the VPN port and power down the appliance. Leaving it online as a fallback leaves the exposure in place.
6. If the VPN must stay for now, treat KEV entries on it as emergency changes, limit who can reach the portal, require MFA, and check for signs of compromise after patching, as BOD 26-04 directs federal agencies to do.

How to verify

• Run an external port scan of your public IP addresses. The VPN listener should no longer answer.
• Pull the access log for one week and confirm each entry names a person, a device and an application.
• Ask your provider for the date each user was moved and the date the VPN was decommissioned, in writing.
• In your RMM (Ares RMM for our clients), confirm every device granted access shows current patch status and active endpoint protection.

Sources

• CISA, CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure, Oct 13, 2026
• CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog, Oct 13, 2026
• CISA, CISA Adds Four Known Exploited Vulnerabilities to Catalog, Oct 14, 2026
• CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog, Oct 16, 2026
• Rapid7, Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
• NIST SP 800-207, Zero Trust Architecture
• CISA, Zero Trust Maturity Model
• CISA and partners, Modern Approaches to Network Access Security (2024)
• CISA, BOD 26-04: Prioritizing Security Updates Based on Risk

Questions about your phones, network or IT? Contact Texwan.