“LevelBlue’s most-exploited CVE lists this year are dominated by those appliances from SonicWall, Fortinet, Palo Alto, Ivanti, and BeyondTrust,” said Doerr. “They’re exposed by design, and a working exploit puts the attacker directly on the network with no user to fool and often no MFA prompt in the way.”
Mitchell Spicer, co-founder and COO of Revelion AI, an autonomous AI penetration-testing platform, backed this assessment.
“Phishing is still a major threat, but exploiting a vulnerability can give an attacker a direct route into a system without needing to persuade an employee to click a link,” said Spicer. “The opportunity is particularly attractive when organizations have internet-facing services that are unpatched, misconfigured, or forgotten.”
