Vulnerabilities
OpenGate VPN flaw CVE-2026-001 exploited within 48 hours of disclosure
Mass scanning began a day after the advisory. Over 11,000 appliances were still exposed a week later.
/ 4 min read
The pre-authentication heap overflow in the OpenGate portal carries a CVSS score of 9.8 and allows remote code execution as root.
Honeypot operators recorded the first exploitation attempts 41 hours after the vendor advisory. By day seven, scanning traffic had grown tenfold and at least four ransomware crews were using the bug.
The vendor has shipped fixed builds for all supported branches. Appliances that cannot be patched immediately should have the web portal disabled from the internet.
Filed under Malware & ThreatsVulnerabilities
Tell us about your environment and a SentriXa security editor will get back to you within one business day.