A joint analysis by Tenable and SentinelOne reveals that edge infrastructure is a shared attack surface, with both state-sponsored actors and cybercriminals independently targeting the same vulnerabilities and vendors. This convergence challenges the perception that edge device exploitation is primarily a nation-state problem, demonstrating a broader threat landscape.
The study, which combined Tenable's exposure telemetry from thousands of customer environments with SentinelOne's digital forensics and incident response (DFIR) casework across 66 CVEs, found a 79% overlap in the vendor attack surfaces observed by both systems, despite minimal CVE-level overlap. This indicates a consistent focus on specific vendors by a diverse range of threat actors.
Twelve CVEs in the combined dataset were confirmed to have multi-nexus attribution, meaning both state-sponsored and criminal actors independently exploited the same vulnerability. These cases spanned five nexus categories: China, Russia, DPRK, Iran, and ransomware. Examples include CVE-2026-15409 in SonicWall SMA1000, exploited by an unattributed actor and ransomware groups; CVE-2023-42793 in JetBrains TeamCity, targeted by Russia's APT29 and DPRK's Lazarus; CVE-2024-3400 in PAN-OS GlobalProtect, exploited by a China-nexus actor and ransomware operators; and CVE-2024-24919 in Check Point Quantum, targeted independently by China's PurpleHaze and Iran's Fox Kitten. The remaining eight multi-nexus CVEs affected products from Fortinet, Citrix, Cisco, and Ivanti.
The analysis highlighted that certain product lines are repeatedly exploited. Ivanti EPMM and Ivanti Connect Secure, for instance, show a new exploited CVE emerging roughly every 8.5 to 13 months, indicating a structural rather than episodic vulnerability-to-exploitation pipeline.
Regarding vendor exposure, F5 products were found to have at least one exposed, actively exploited CVE in 54% of customer environments. Fortinet, often associated with edge device attacks in media, was mid-pack with 25% container-grain exposure, similar to Check Point, Ivanti, and Citrix. Citrix customers exhibited the slowest remediation patterns, with a median time to patch of 461 days.
A significant finding was that high-priority CVEs take longer to remediate, not less. Across Tenable's list of 238 high-priority CVEs, the median remediation time was 146 days, a 24-day gap compared to the 122 days for all other CVEs. This delay creates extended windows of opportunity for attackers. External data, including the 2026 Verizon Data Breach Investigations Report (DBIR), corroborates this trend, noting an increase in median patch time and that only 54% of edge device KEVs were fully remediated.
The difficulty in patching edge devices is attributed to several factors: they are network boundaries, meaning updates can cause downtime; they often don't run standard endpoint agents; they may require firmware-level updates with manual validation; and they frequently lack active support contracts. These operational challenges mean that the devices most critical to patch are often the hardest to update.
The study concludes that defending against one category of threat actor on edge devices necessitates defending against all, as the attack surface is shared. Organizations are advised to implement multiple defense-in-depth strategies, including rapid patching, minimizing the attack surface through feature-set minimization, and running endpoints in protect mode to mitigate lateral movement from initial access compromises.
