As legacy VPN vulnerabilities and AI-driven exploits expose corporate networks, zero-trust architecture is emerging as the imperative replacement, making systems invisible and preventing broad network access.
For more than two decades, VPNs have been the de facto standard and the default way to connect remote users to the corporate network. It worked when employees sat in offices and applications ran in the data center. That world is gone, but the VPN has stuck around, and the security bill is now coming due.
There are plenty of reminders. Ransomware groups, including Qilin and Settra, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto’s PAN-OS GlobalProtect and Prisma Access, to create unauthorized VPN sessions and then move laterally across victim networks using tools such as Cobalt Strike, BloodHound, and SharpHound, according to Cybersecurity News. Exploitation began just four days after disclosure in May, and CISA added the flaw to its Known Exploited Vulnerabilities catalog weeks later, according to IBM X-Force.
This is a pattern, not a bug
This isn’t a Palo Alto issue; it’s a larger industry trend. Look at the past 18 months across the major remote-access vendors:
- Ivanti Connect Secure (CVE-2026-104935). On Oct. 13, Ivanti disclosed an actively exploited authentication bypass that enables unauthenticated remote command execution. CISA said attackers were using it for credential theft and data exfiltration. Volexity found that the attacker chained it with a separate privilege-escalation flaw to gain root access on a fully patched appliance. CISA has now flagged 36 Ivanti vulnerabilities as exploited since 2021.
- WatchGuard Firebox (CVE-2025-9242 and CVE-2025-14733). Two critical flaws, both rated 9.3, affected the same IKEv2 VPN service within months. CISA flagged the first as exploited, and WatchGuard warned that even after deletion, previous VPN configurations could still render firewalls vulnerable. CISA has since confirmed that ransomware campaigns are using it.
- Citrix NetScaler Gateway (CVE-2025-5777, “CitrixBleed 2”). Public exploits demonstrated the ability to hijack user sessions and bypass MFA authentication, according to CSO.
- SonicWall SSL VPN (CVE-2024-40766). Akira ransomware affiliates kept breaking in for a year after the patch because migrated local passwords were never reset, according to SC Media.
Different vendors, different code bases, same outcome. The VPN concentrator sits on the public internet; it’s designed to be found. Once an attacker gets past it, they are on the network and have unfettered access to every user and every bit of data on the company network. The WatchGuard and SonicWall cases also show that patching doesn’t close the door; stolen credentials and persistence outlast the fix. (Read more about how AI erased the 50-day patch window)
The Mythos moment
As bad as this is, I believe it is about to get much worse. In April, Anthropic launched Project Glasswing and revealed that its Claude Mythos Preview model had identified thousands of zero-day vulnerabilities, including flaws in every major operating system and browser, plus a 27-year-old bug in OpenBSD, an operating system widely used to run firewalls. Anthropic said the model found nearly all of them and built many exploits on its own, without human intervention.
The numbers since then have been off the charts. Glasswing partners found more than 10,000 high- or critical-severity vulnerabilities in a single month, according to Anthropic’s initial update. Anthropic now says the bottleneck has shifted from finding bugs to verifying, disclosing, and patching them. Microsoft in May warned that its patch releases will continue to grow.
Glasswing is defensive, and its list of founding partners is impressive. However, VPN gateways run large, aging code bases, sit on the internet, and guard the company’s most valuable access. That is exactly the kind of target AI-driven discovery will chew through. Defenders will uncover more flaws, which means more emergency patches. Attackers will eventually have comparable tools; a Discord group has already gained unauthorized access to Mythos through a third-party contractor, according to The Daily Star. The four-day gap between disclosure and exploitation that the industry has seen over the past few months will shrink to hours. No team can patch its way out of that math. AI will certainly help, but security teams are always behind in the CVE patching cat-and-mouse game.
Why zero trust is the path forward
The problem isn’t any vendor’s coding practices; it’s the architecture. A VPN puts a door on the internet, verifies who walks through it, and then trusts them once inside. Every CVE above exploits that model.
To get a sense of the architectural question, I reached out to Zscaler, an early pioneer of zero trust. Adam Geller, the company’s chief product officer, said, “The recurring vulnerabilities in legacy VPNs aren’t isolated software bugs. They are an architectural limitation.” Geller added, “Legacy VPNs expose perimeter gateways to the open internet and, if breached, grant broad network access.”
“A true zero-trust architecture flips that model. It makes internal systems invisible to the public internet, inspects all traffic inline, prevents lateral movement, and connects users only to the applications they are authorized to use, never to the underlying network. That matters even more in the agentic AI era, where we’re seeing AI agents gain unchecked access and wreak havoc in environments that the right architecture could have protected from the beginning.”
The agentic point deserves emphasis. Give an agent acting at machine speed, or an attacker who has hijacked one, broad network reach, and the blast radius is enormous. Zero trust shrinks it to a single application.
Recommendations for network and security leaders
Inventory every internet-facing access point. Most organizations have more VPN concentrators and remote-access portals than they realize, often leftovers from acquisitions or pandemic-era projects. You can’t retire what you can’t see.
Assume compromise of legacy gateways. Patching is necessary, but the Ivanti, WatchGuard, and SonicWall cases show it is not sufficient. After every critical advisory, terminate active sessions, rotate credentials and hunt for persistence rather than trusting a clean integrity check.
Prioritize by risk, not by convenience. Move third-party contractors, privileged administrators, and access to crown-jewel applications to zero trust first. These users and assets pose the greatest risk, and application-level access delivers the fastest payback.
Treat AI agents as first-class identities. Every agent should have its own identity, least-privilege access to specific applications, and full inline inspection of its traffic. Don’t let agents inherit a human user’s network-level access.
Plan for a higher patch tempo. AI-driven vulnerability discovery will increase the volume of advisories across the stack. Budget operations time accordingly, and use that pressure as the business case for reducing the number of internet-facing appliances you must maintain.
Set a retirement date. Zero-trust migrations stall when VPNs remain available as a fallback option. Establish a timeline, communicate it, and stick to it.
Final thoughts
So, is it time to retire VPNs? Yes, but as with all things in tech, VPNs won’t vanish overnight, and niche use cases will linger. Yet the same class of failure keeps recurring across every major vendor, and AI will accelerate how quickly those failures are found and exploited. Leaders who treat VPN breaches as one-off patching events are fighting the last war. The organizations that come out ahead will stop putting doors on the internet altogether and connect users, devices, and AI agents only to what they need. The time to begin that transition isn’t after the next emergency directive. It’s now.