Edge devices become a shared doorway as patch windows shrink to three days

One week, two kinds of attacker, one layer

Over four days from 27 to 30 September, the US Cybersecurity and Infrastructure Security Agency (CISA) added four entries to its catalogue of vulnerabilities proven to be used in attacks (KEV). Three of them were products at the edge of the network. Edge devices are the boxes that connect an organisation's network to the internet, such as gateways, VPNs, routers and SD-WAN appliances.

Citrix disclosed two NetScaler flaws rated 9.5 on 27 September. According to Help Net Security, they had been exploited for weeks before the announcement. The attackers dropped web shells and wiped their traces, and the source described the operation as probable state-linked espionage. On 30 September came Cisco's SD-WAN Manager flaw, rated 9.8. Rapid7 says it is the product's fifth zero-day of 2026.

The same week was busy on the ransomware side too. On 30 September, a Europol-backed operation took down five servers belonging to the KillSec gang. Since 2024 the gang had carried out about 1,000 attacks, 500 of them successful. It has not been disclosed which entry route KillSec used in those attacks. CISA data do show, however, that 6 of the 56 edge product entries added to the catalogue in 2026 are flagged as used in ransomware campaigns.

The patch window has shrunk to three days

Our calculation from the KEV catalogue shows that the 245 vulnerabilities added in 2025 had a median federal patch deadline of 21 days. For the 247 added in 2026 up to 1 October, the median fell to three days. In 124 entries the deadline is three days or less, compared with seven in 2025.

Volume has grown alongside speed. In September 2026, 43 vulnerabilities joined the catalogue, about 2.7 times the 16 of September 2025 and the highest month of the year. Of the 43 entries, 18 come from Cisco, Citrix, Fortinet, SonicWall, Check Point, F5, MikroTik, Zyxel and Arista products. The deadline for the Cisco SD-WAN flaw is 3 October. Because a single HTTP request grants administrator rights, three days is not too little; it is necessary.

The problem is that the three-day window binds only US federal agencies. Private companies and public bodies in other countries can face the same flaw within the same three days, but they are under no obligation to meet that deadline. In the Citrix case, exploitation began weeks before disclosure. When the window opened, some networks were therefore already living with an attacker inside.

Geopolitics widens the attack surface

According to Cisco Talos, the China-linked group UAT-11587 planted the Antino backdoor on about 350 devices in eight countries between September 2025 and July 2026. Targets included defence, foreign affairs and think-tank organisations in Taiwan, India, the Philippines and Pakistan. The Record reports that the campaign was spotted in March 2026 through targeted emails. The backdoor takes commands via Microsoft 365 every 10 seconds.

The identity layer is on the same list. Proofpoint says the pro-China group TA419 has impersonated a former White House science policy official since 8 July. It sent fake advisory board invitations to AI policy experts. According to The Register, the group had also impersonated an Anthropic executive in February 2026. One of its two fake offers was a fictitious Senate report on AI export controls. As this field becomes a bargaining chip, its experts become targets too.

The energy crisis and the war are having the same effect in the Gulf. A CloudSEK report cited by The National shows ransomware listings in the region rising from 17 in April 2025 to 357 in June 2026. In the UAE, daily attack attempts climbed from 200,000 before the war to about 800,000.

The cost accounting has not caught up

The ransomware attack on Keio on 26 September did not stop its trains. It did, however, cut card payments at its supermarkets, hotels and bus ticket counters. At Times Car, driving licence and identity data for 6.6 million accounts leaked. In Türkiye, the data protection authority KVKK announced nine breaches on 30 September. Across the cases with disclosed figures, at least 1,033,853 people were affected, and the Papara Menkul breach began with Okta-targeted phishing.

Insurance prices are moving the other way. According to the Marsh index, global cyber insurance prices fell 4% in the second quarter of 2026, the 12th consecutive quarter of decline. In the India, Middle East and Africa region the fall was 14%. Marsh attributes the decline to ample capacity, low reinsurance costs and strong profitability. September's 43 exploited vulnerabilities are not yet in this pricing.

Financial markets are calm as well. Cboe data show the VIX volatility index at 16.39 on 1 October. That calm suggests cyber risk is still confined to the balance sheets of individual companies and insurers. It has not moved into the systemic risk premium.

What to watch

Three indicators stand out for the next three months. The first is whether the monthly number of edge products added to KEV stays above September's 18. The second is whether Marsh's third-quarter index extends the fall in cyber prices to a 13th quarter. The third is the financial sector's share in KVKK's breach announcements, which continued with nine breaches on 30 September.

The gap between a three-day patch tempo and insurance prices that have fallen for 12 quarters will not stay open for long. When it closes, the cost will show up first in premiums and deductibles. After that it will reach regulators' patching and notification timetables.