The Management Plane You Left Out of Scope: SD-WAN, RMM, Federation and End-of-Support Edge in 2026

Most penetration test scopes are drawn along a line that made sense a decade ago: "the network" on one side, meaning externally reachable hosts and their listening services, and "the application" on the other. Between them sits a category that fits neither and is routinely written out of scope.

That is the category being exploited in 2026: orchestrators, RMM platforms, federation servers, MDM gateways and end-of-support edge hardware.

A note on classification

Coverage collapses very different events into one headline, so this site classifies each. Category A is a guardrail bypass or jailbreak. Category B is platform misuse, an external attacker using a vendor's product against third parties. Category C is a product vulnerability in shipped software. Category D is a corporate breach of the vendor itself. Category E, defined here on first use, is a model-initiated action during an evaluation: the vendor's own model acting against a real third party with no attacker involved.

Every incident named here is Category C: product vulnerabilities with published fixes or documented mitigations, all recorded by CISA as exploited in the wild. None is a breach of Cisco, N-able, Microsoft, Palo Alto Networks or Ivanti. Category C remediation is yours to perform, not your vendor's to announce.

The scoping gap: five asset classes that are neither network nor application

The unifying property is authority. These assets do not hold the crown jewels; they hold the ability to reach whatever does. An SD-WAN controller does not store your customer database, but it decides which packets reach it.

Cisco SD-WAN under emergency directive: collect evidence before you patch

On 25 February 2026 CISA added two Cisco SD-WAN vulnerabilities to the Known Exploited Vulnerabilities catalog and issued Emergency Directive 26-03 alongside them. It names CVE-2026-20127 and CVE-2022-20775, and covers Cisco Catalyst SD-WAN Manager (formerly vManage), "regardless of configuration", and Cisco Catalyst SD-WAN Controller (formerly vSmart).

The sequencing is the unusual part: ED 26-03 states its required actions "MUST be taken in the identified order": Identify, Collect, Update, Hunt, Harden, Report. Artefact collection was due 26 February, applying Cisco's updates 27 February. It puts evidence preservation ahead of patching, because patching a compromised orchestrator destroys the artefacts that would have proved it was compromised. Those artefacts include an administrative diagnostic dump, a copy of /home for user activity and keys, externally stored syslogs, and a snapshot of virtual disk and memory.

The consequence clause makes this an emergency, not a patch cycle. Where a root account compromise is identified, agencies must report to CISA and "Rebuild control management plane, which will require deploying fresh vManage, vSmart, and vBond instances from patched OVA or qcow2 images and migrate edges to the new infrastructure." That is reconstruction of the estate's routing authority from clean media, not remediation.

CISA's supplemental hunt guidance sets the window: "malicious activity likely began in 2023". Its detection sections cover unexpected software downgrades and reboots, application reversion, rogue control-plane peering, and abuse of SSH authorised keys: behavioural indicators on the orchestrator itself, not signatures on the wire. ED 26-03 binds Federal Civilian Executive Branch agencies and does not apply to contractors, but the guidance is public and the reasoning travels.

Chaining old and new: why patching only the 2026 CVE left the escalation half in place

CVE-2026-20127 is a peering authentication failure. NVD as primary source and Cisco as CNA both score it CVSS 3.1 10.0 Critical on an identical vector. The description is precise about what an attacker gets: the ability to "log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account", from which "the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric."

CVE-2022-20775 supplies the missing half. Published in September 2022 and scored 7.8 High by both NVD and Cisco, it lets an authenticated local attacker execute arbitrary commands as root through improper access controls in the application CLI. Alone it reads like backlog; chained behind the authentication bypass, it is the step from network administrator to root.

CISA added both on the same day with the same 27 February deadline. The records disagree on weakness classification: NVD assigns CVE-2022-20775 the primary CWE-22, Cisco assigns CWE-25 as secondary, and the KEV entry lists CWE-25 with CWE-282. CISA's SSVC decision points separate them further, marking CVE-2026-20127 automatable and CVE-2022-20775 not. Programmes that sort by score and age patched the 10.0 and queued the 7.8; two KEV entries added on the same date for the same product family are a chain hint.

RMM as initial access: an incomplete patch, and persistence that looks like ordinary TLS

N-able N-central performs privileged execution across a managed endpoint fleet, so compromising it is equivalent to compromising every machine it manages. Two KEV entries landed within twenty-four hours of each other in August 2026, the second because the first fix did not hold. The NVD description of CVE-2026-18577 is one sentence: "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1". CISA's KEV entry states the same relationship. Note the ordering anomaly: the follow-on CVE was catalogued a day before the original.

N-able published hotfix build 2026.3.1.7 on 2 August 2026, stating the issue affects "all N-central instances not running 2026.3.1". Hosted instances upgrade automatically; self-hosted ones do not.

The detection guidance is the more instructive part. N-able tells administrators to look for a file named svchost.exe in a user's Documents folder and a registered Windows service named Cloudflared, plus a published list of inbound addresses to check in firewall logs. The second indicator generalises: a tunnelling client running as a service opens an outbound TLS session to a large, reputable CDN and then accepts inbound traffic over it, so there is no inbound firewall rule, no listening port on an external scan, and nothing an egress policy permitting general HTTPS would flag. Detection has to come from the endpoint.

N-able is not isolated; the class accumulated KEV entries through 2026: BeyondTrust Remote Support and Privileged Remote Access (CVE-2026-1731, 13 February, ransomware-flagged), SimpleHelp (CVE-2024-57726 and CVE-2024-57728, 24 April; CVE-2026-48558, an OIDC authentication bypass, 29 June), and ConnectWise ScreenConnect (CVE-2024-1708, 28 April, also ransomware-flagged).

AD FS: a "local, High" score on the asset that issues your authentication tokens

CVE-2026-56155 is insufficient granularity of access control in Active Directory Federation Services, allowing an authorised attacker to elevate privileges locally. Two things deserve precision.

First, NVD assigned no primary score. The 7.8 High quoted everywhere is Microsoft's own secondary CVSS 3.1 metric, on AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Any report presenting 7.8 as an NVD rating is misattributing it.

Second, the deadline shows the tiering cascade at work. CISA added this CVE on 14 July 2026 due 28 July, a fourteen-day window, while adding a SharePoint vulnerability the same day with a three-day window. The difference is not importance but SSVC inputs: CISA marked the AD FS issue automatable "no", and a local vector means an attacker needs a foothold first. What the model cannot express is blast radius. AD FS issues authentication tokens for every federated application behind it, so escalation there compromises the trust anchor for a federated estate, not one host.

One quiet signal is easy to miss: CISA's KEV notes field links to Microsoft Learn's "Active Directory Federation Services (AD FS) decommission guide", whose stated purpose is to describe the recommended way to decommission AD FS servers. A remediation reference pointing at a decommissioning guide says something about the product's future.

When the maximum score is conditional

PAN-OS GlobalProtect, CVE-2026-0257. The scores diverge and both are authoritative. NVD's primary CVSS 3.1 rating is 9.1 Critical; Palo Alto Networks, as CNA, rates it 7.8 High under CVSS 4.0. Neither is wrong, and the CVSS 4.0 vector carries threat metrics the CVSS 3.1 score cannot express, including exploit maturity "Attacked" and provider urgency "Red". A team reading only the 7.8 and skipping those fields misreads the vendor's own data.

Applicability is a configuration question: "This issue affects firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists." Short of upgrading, the vendor's mitigations are a certificate generated exclusively for authentication override cookies and never reused, or disabling authentication override in the portal and gateway configuration. Panorama and Cloud NGFW are not impacted; Prisma Access is. Palo Alto credits its internal research teams and reports "limited exploit attempts on unpatched PAN-OS devices without mitigations applied". CISA flags the CVE for known ransomware campaign use.

Ivanti Sentry, CVE-2026-10520. The 10.0 Critical is CNA-supplied; NVD assigned no primary score, so a 10.0 presented as an NVD rating is again misattributed. More importantly, the KEV entry carries a precondition that changes the exposure calculation: "This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors."

Both are deployment-state questions. A credentialed scan reports your PAN-OS build, not whether authentication override cookies are enabled and their certificate is shared; your Sentry version, not whether the appliance sits unmanaged with externally reachable endpoints.

On-premises SharePoint: one bug class, four July entries on a 72-hour clock

On-premises SharePoint belongs here because of what it runs as: a broad-reach service account and a search index that has already crawled everything it can read.

Six SharePoint vulnerabilities entered KEV between 18 March and 22 July 2026. Four carry CWE-502, deserialization of untrusted data, the same weakness class as CVE-2025-53770, the July 2025 entry. Four were added in July 2026, each with a three-day window: CVE-2026-45659 on 1 July, CVE-2026-56164 on 14 July, CVE-2026-58644 on 16 July, CVE-2026-50522 on 22 July.

CVE-2026-56164 repays careful reading: one NVD record carries two irreconcilable assessments. NVD's primary CVSS 3.1 score is 9.8 Critical on C:H/I:H/A:H; Microsoft's own secondary score in the same record is 5.3 Medium on C:N/I:L/A:N. That is a disagreement about whether confidentiality and availability are affected at all. CISA's SSVC assessment sits between them, recording technical impact as "partial" rather than "total" while still assigning the fastest deadline tier. Record both rather than picking the number that suits the argument.

End-of-support edge devices: a lifecycle finding, not a CVE

CISA issued BOD 26-02, "Mitigating Risk From End-of-Support Edge Devices", on 5 February 2026. It defines end of support as hardware, firmware and software no longer receiving timely, supported updates from the manufacturer, including CVE patches, security updates, hotfixes and defects. It defines edge devices as "All technology devices that reside on the boundary of an agency's network and are accessible from the public internet", explicitly including firewalls, routers, switches, network security appliances and software defined networks. Its rationale matches this post's theme: edge devices are attractive for their extensive reach into an organisation's network and their integrations with identity management systems.

Required actions are lifecycle actions, not patching actions. Immediately and until rescinded, agencies must update each vendor-supported edge device running end-of-support software, including firmware, to a supported version where that does not break mission-critical functionality; within three months they must inventory all devices on the CISA EOS Edge Device List and report it. BOD 26-02 applies to FCEB agencies rather than contractors, and excludes operational technology and FedRAMP-authorised cloud services placed out of scope by OMB Memorandum M-24-15.

This is a testing problem, not just a procurement one. No CVE describes the condition itself, so unless a scanner ships a lifecycle check for that exact model, there is nothing to match and no ticket to close. The finding is "this device will never be patched again and it terminates your perimeter", a lifecycle judgement an inventory-aware assessment produces and a signature-driven scan does not.

Rewriting the scope: the ten management-plane assets to add to your next statement of work

If your last statement of work said "external perimeter and internal Active Directory", these additions would have covered the 2026 record.

1. SD-WAN orchestration and control plane, with configuration and peering review.

2. RMM console and agent fleet: authentication paths in, and what an operator can execute downstream.

3. Federation and token issuance, as a distinct trust boundary, not a footnote to the domain.

4. MDM and EMM gateways, including whether the inbound proxy is managed and what is internet-reachable.

5. VPN portal and gateway configuration state: authentication override settings and certificate reuse.

6. End-of-support edge hardware, inventoried against vendor lifecycle dates.

7. On-premises collaboration servers, including service account reach and search index contents.

8. Out-of-band management: baseboard controllers, console servers, hypervisor consoles.

9. Reachability of the management interfaces, and which identities authenticate to them.

10. Evidence preservation capability: could you collect what ED 26-03 demands before patching?

That last item is the one most often missing: many organisations discover mid-incident that their orchestrator logs only locally and rotates hourly.

How we scope this at Stingrai

Stingrai has been doing offensive security since 2021, from Toronto and London. Stingrai Inc holds firm-level CREST accreditation as a penetration testing service provider, distinct from the individual CREST CRT certifications team members hold; the team has 18 published CVEs and 5.0 out of 5.0 across 19 Clutch reviews.

Management-plane testing is human-led network and infrastructure work; Snipe, our autonomous agent, covers web application testing only. Human validation of every finding is a property of our Hybrid engagements specifically, and the "No High or Critical Finding = Don't Pay" guarantee applies to the Autonomous and Hybrid web application tiers, not to Enterprise. Pricing is published in full; management-plane work is quoted against the asset inventory. Among common frameworks only PCI DSS v4.0.1 mandates penetration testing across a general population, and CMMC at Level 3 only, so these assets belong in scope because of the exploitation record above, not because an auditor demanded it.

Related reading: external network penetration testing scope and cost, what an Active Directory security assessment covers, and how to scope a penetration test in 2026.

Frequently Asked Questions

What is CISA Emergency Directive 26-03?

ED 26-03 is a CISA emergency directive from February 2026 requiring Federal Civilian Executive Branch agencies to inventory Cisco SD-WAN systems, collect forensic artefacts, apply updates, hunt for compromise, harden and report. It names CVE-2026-20127 and CVE-2022-20775, covering Cisco Catalyst SD-WAN Manager regardless of configuration and Cisco Catalyst SD-WAN Controller. Its actions must be taken in the stated order, placing forensic collection before patching so evidence of compromise is not destroyed. It binds federal agencies, not contractors.

Do you need to rebuild Cisco SD-WAN after a compromise?

If a root account compromise is identified, ED 26-03 requires it: rebuild the control management plane by deploying fresh vManage, vSmart and vBond instances from patched OVA or qcow2 images and migrating edges to the new infrastructure. Patching alone does not discharge that obligation, because an attacker who reached root may hold persistence that survives a software update. Organisations outside federal scope are not bound by it but face the same reasoning.

Is patching N-able N-central enough?

Upgrading to 2026.3.1 or later is necessary but not sufficient. CVE-2026-18577 exists because the earlier patch for CVE-2026-18556 was incomplete, a relationship stated in both the CVE record and the CISA KEV entry, so version currency must be verified rather than assumed. N-able also publishes indicators of prior compromise, which should be checked before assuming a clean upgrade.

How do attackers abuse Cloudflare Tunnel for persistence?

A tunnelling client installed as a service opens an outbound TLS connection to a large content delivery network and then receives inbound traffic back over that session. Because it is outbound and terminates at a reputable destination, it needs no inbound firewall rule, exposes no listening port to an external scan, and passes egress policies permitting general HTTPS. N-able's guidance for CVE-2026-18577 tells administrators to look for a registered service named Cloudflared, so detection has to be endpoint-side.

Should AD FS be replaced instead of patched?

The primary record does not say replace it, but it points that way. CISA's KEV entry for CVE-2026-56155 links Microsoft Learn's AD FS decommission guide, a document written to describe the recommended way to decommission AD FS servers. Because AD FS issues authentication tokens for every federated application behind it, migration belongs in the plan and patching is the interim control. The quoted 7.8 High is Microsoft's secondary score; NVD assigned none.

Which PAN-OS GlobalProtect configurations are affected by CVE-2026-0257?

Palo Alto Networks states the issue affects firewalls with a GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists. Panorama and Cloud NGFW are not impacted; Prisma Access is. Short of upgrading, the vendor offers two mitigations: a dedicated certificate used only for authentication override cookies, or disabling authentication override on portal and gateway. A version-only inventory cannot answer the question.

Is on-premises SharePoint still being exploited?

Yes. Six SharePoint vulnerabilities entered the CISA Known Exploited Vulnerabilities catalog between 18 March and 22 July 2026, four of them in July alone, each July entry carrying a three-day deadline. Four of the six carry CWE-502, deserialization of untrusted data, the same weakness class as CVE-2025-53770, the July 2025 entry. For CVE-2026-56164 the same NVD record holds a 9.8 Critical NVD primary score and a 5.3 Medium Microsoft secondary score.

Should RMM tools be included in a penetration test scope?

Yes, and they usually are not. A remote monitoring and management platform holds privileged execution rights on every endpoint it manages, so compromising the console is functionally equivalent to compromising the managed fleet. The 2026 KEV record carries repeated entries across this class, including N-able N-central, SimpleHelp, ConnectWise ScreenConnect and BeyondTrust products, several flagged for known ransomware campaign use. Scope the authentication paths into the console and what an operator can execute downstream.

References

• CISA, Emergency Directive ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems

• CISA, Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems: https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems

• CISA, BOD 26-02: Mitigating Risk From End-of-Support Edge Devices: https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices

• CISA, Known Exploited Vulnerabilities Catalog, catalogVersion 2026.08.07: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

• NVD, CVE-2026-20127: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-20127

• NVD, CVE-2022-20775: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-20775

• NVD, CVE-2026-20245: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-20245

• NVD, CVE-2026-20262: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-20262

• NVD, CVE-2026-18577: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-18577

• NVD, CVE-2026-18556: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-18556

• NVD, CVE-2026-56155: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-56155

• NVD, CVE-2026-56164: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-56164

• NVD, CVE-2026-0257: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-0257

• NVD, CVE-2026-10520: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-10520

• Palo Alto Networks Security Advisories, CVE-2026-0257: https://security.paloaltonetworks.com/CVE-2026-0257

• N-able Status, N-central 2026.3 Hotfix 1, Mitigation for CVE-2026-18577: https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/

• Microsoft Learn, Active Directory Federation Services (AD FS) decommission guide: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide