Top 10 Network Security Vulnerabilities to Watch in 2026

The network vulnerabilities to watch in 2026 are the ones attackers already exploit: flaws in internet-facing VPNs, firewalls and gateways, remote access that still trusts a password, and the internal weaknesses that turn one foothold into control of Active Directory. Exploitation of vulnerabilities is now the most common way into a breach, at 31% of breaches with a known initial access vector in Verizon's 2026 Data Breach Investigations Report, and exploits started 32% of the intrusions Mandiant investigated in 2025. The ten below run from the perimeter inward, each with a dated 2025 or 2026 example from a primary source, how attackers use it, how a network penetration test finds it, and the fix.

The ten at a glance

How this list was built

The order runs from the perimeter inward: items 1 to 4 decide whether an attacker gets in, items 5 to 9 decide how far they get, and item 10 is the wireless edge that is usually scoped as a separate test. Exploitation evidence comes from CISA's Known Exploited Vulnerabilities (KEV) catalog, read on 9 November 2026 at version 2026.11.09, Verizon's 2026 DBIR, Mandiant's M-Trends 2026, Google Threat Intelligence Group's review of 2025 zero-days, and vendor and government advisories.

Testing evidence comes from Stingrai's own State of Penetration Testing 2026, which covers 55 tests between October 2024 and August 2026. Internal network tests returned a median of 11 verified findings, 92% of them High or Critical, and outdated or unpatched software made up 56.9% of internal network findings. External network tests returned a median of one finding. The perimeter produces few findings, but they are the ones attackers exploit at scale; the inside of the network produces many, and they decide how far an intrusion spreads.

1. Edge VPN, firewall and gateway exploits

What it is. Flaws in internet-facing VPN concentrators, firewalls, application delivery controllers and secure access gateways that let an unauthenticated attacker run code, bypass login or read session data. These appliances sit outside the reach of endpoint detection and handle the credentials users type into them.

Evidence from 2025 and 2026. Since January 2025, CISA has added 81 CVEs from Cisco, Fortinet, Ivanti, Citrix and SonicWall to the KEV catalog: 33 of the 245 entries added in 2025 and 48 of the 289 added in 2026 up to 9 November. Google Threat Intelligence Group counted 14 edge-device zero-days among the 90 zero-days it tracked in 2025 and says that figure "likely underrepresents the true scale of activity." Mandiant estimates the mean time to exploit at minus seven days, meaning exploitation routinely starts before a patch exists. Verizon's 2026 DBIR says small-business ransomware victims were picked because they had compromised credentials (38%) or "unpatched vulnerabilities in edge devices (29%)."

How attackers use it. Mass scanning for a vulnerable build, then web shells, implants and credential harvesting on the appliance itself, followed by a move inside with the access the appliance already has. Persistence often outlives the patch. Cisco saw the actor behind its 2025 ASA campaign "modifying ROMMON to allow for persistence across reboots and software upgrades," and in April 2026 CISA and Cisco reported a new mechanism "preserved across upgrading to the fixed releases that were published in September 2025."

How a network penetration test finds it. An external test starts with discovery, because the appliance nobody listed is the usual miss: certificate transparency logs, DNS and the owned IP ranges reveal every VPN portal, gateway and management page. The tester fingerprints each build, maps it to KEV entries and vendor bulletins, and confirms exposure without crashing the device. An assumed-breach test from the appliance's network segment then shows what an attacker with a shell on it could reach. Our guide to external network penetration testing covers the scope.

The fix. Keep an inventory of every internet-facing appliance with its build and support date, subscribe to each vendor's security bulletins, and patch on KEV time. Under BOD 26-04, issued on 10 June 2026 for US federal civilian agencies, a publicly exposed asset with a KEV-listed flaw that gives total control must be fixed within three days, with forensic triage. Hunt before you patch, because a patch does not remove a web shell, and on any indicator rebuild from clean firmware and rotate every secret the device held. Our NetScaler compromise and patch checklist walks through that sequence for one vendor.

2. Remote access without phishing-resistant MFA

What it is. VPN, virtual desktop and remote desktop gateways that accept a password alone, or a second factor that can be phished, approved by mistake or replayed: SMS and voice codes, push approvals and one-time passwords. Phishing-resistant MFA, meaning FIDO2 security keys, passkeys or certificate-based authentication, binds the login to the real service, so it cannot be relayed through a fake portal.

Evidence from 2025 and 2026. A second factor only helps if every login path enforces it. On 6 November 2026 CISA added SonicWall CVE-2026-19868 to KEV: in the SonicOS SSLVPN service, a user "with valid credentials for an alternate authentication method" can "bypass SAML authentication controls," and with them "SAML-enforced multi-factor authentication (MFA)." CISA's Akira ransomware advisory, updated on 13 November 2025, says the group gets in "through a virtual private network (VPN) service without multifactor authentication (MFA) configured," by stealing credentials, exploiting SonicWall CVE-2024-40766 or "brute-forcing VPN endpoints," and puts Akira's ransom proceeds at about US$244.17 million as of late September 2025. Verizon's 2026 DBIR finds credential abuse is the first step in 13% of breaches but appears at some point in 39%, and VPN access made up 44% of the access offered for sale by initial access brokers in its data. A second factor can leak too: Google Threat Intelligence Group reported in July 2025 that UNC6148 used credentials and one-time password seeds stolen from SonicWall SMA 100 appliances to regain access "even after organizations have applied security updates."

How attackers use it. Password spraying and credential stuffing against VPN portals, logins bought from initial access brokers, push fatigue, and help desk social engineering to get a second factor approved or reset. Mandiant ranked voice phishing as the second most common initial infection vector of 2025, at 11%.

How a network penetration test finds it. The tester lists every remote access entry point, including legacy portals, alternate VPN profiles and local accounts on the appliance itself, then checks whether MFA is enforced on each path, including alternate authentication methods left enabled beside single sign-on, whether lockout and rate limiting work, and which factor types are accepted. With written permission, a controlled password spray against agreed accounts shows whether weak passwords are in use.

The fix. Require phishing-resistant MFA on every remote access path and for every administrator, remove local appliance accounts or put them behind MFA, retire legacy VPN profiles, and rotate passwords and one-time password seeds after any appliance compromise. Give the help desk a verification procedure that a convincing caller cannot talk past.

3. Exposed management interfaces and default credentials

What it is. Administrative web consoles, SSH, SNMP, APIs and firewall managers reachable from the internet or from ordinary user networks, together with factory-default, shared or vendor hard-coded passwords.

Evidence from 2025 and 2026. Amazon's threat intelligence team reported on 18 March 2026 that the Interlock ransomware group exploited CVE-2026-20131, a flaw in the web-based management interface of Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco disclosed it on 4 March. CISA added it to KEV on 19 March, and on 29 July added CVE-2026-20316, static credentials for a low-privileged account on the same product; both carry the known-ransomware flag. Fortinet's advisory for CVE-2026-24858 says two malicious FortiCloud accounts used a single sign-on bypass to log in to devices registered to other accounts, then created local administrator accounts. Cisco's IOS and IOS XE SNMP flaw CVE-2025-20352 was exploited "after local Administrator credentials were compromised," according to Cisco's advisory. SSH is a management plane too: on 9 November 2026 CISA added CVE-2026-123158 to KEV with forensic triage required. In OpenSSH before 10.6p2 on Linux systems that use musl libc without PAM, Alpine Linux among them, "any password between 256 and 1024 characters succeeds" for some account configurations, and Alpine's advisory of 5 November says an attacker "who can reach your SSH port can log in without knowing any password." And CISA's December 2025 advisory AA25-343A describes hacktivists reaching operational technology through internet-facing VNC, "typically with default, weak, or no passwords."

How attackers use it. They scan for login pages and management ports, try default and leaked credentials, and exploit pre-authentication flaws in the management plane, which usually grants control of the whole device. From there they add administrator accounts, change rules and watch traffic; M-Trends 2026 describes espionage groups "leveraging native packet-capturing functionality" on network devices to intercept "plaintext credentials as they transit the network."

How a network penetration test finds it. Port and service discovery across every owned range identifies the administrative interfaces, which the tester then checks for default and vendor credentials from an agreed list, guessable SNMP community strings and unauthenticated API endpoints. Running the same checks from a standard user VLAN shows whether management planes are reachable from inside.

The fix. Put every management interface on a dedicated administration network or behind a jump host, turn off management from the WAN, replace SNMPv1 and v2c with SNMPv3 restricted to monitoring hosts, use key-based SSH with password authentication turned off, change every default at installation, disable vendor cloud sign-in for administrators where nobody uses it, and review administrator accounts for entries nobody created.

4. End-of-life and unpatched devices

What it is. Firewalls, routers, VPN appliances, switches and servers that no longer receive security updates, or that do but have not been patched. A device past its support date stays exposed to every flaw found after it.

Evidence from 2025 and 2026. CISA's BOD 26-02, issued on 5 February 2026, cites "widespread exploitation campaigns by advanced threat actors targeting EOS edge devices" and gives federal civilian agencies 12 to 18 months to remove end-of-support edge devices. Old flaws keep returning: CISA added CVE-2008-4250, the Windows Server service flaw Microsoft fixed in MS08-067 in October 2008, to KEV on 20 May 2026, and CVE-2008-4128, a Cisco IOS 12.4 HTTP administration flaw, on 13 July 2026. Cisco observed the 2025 campaign's ROMMON tampering only on ASA 5500-X models released before Secure Boot, models whose last date of support fell between 2022 and 2025. Verizon's 2026 DBIR found only 26% of KEV vulnerabilities fully remediated in 2025, down from 38%, with a median of 43 days to full resolution, and for 80% of the persistently exploited KEV flaws organizations "would have had about two years' advance notice in which to patch."

How attackers use it. Public exploits for old flaws are cheap and reliable, no patch is coming for an unsupported device, and hardware without secure boot lets an implant survive reboots. Unsupported devices are also reused as attack infrastructure: Verizon's internet scans found between 45,000 and 50,000 end-of-life wireless modems with a publicly accessible management interface between June and October 2025, devices it says are being repurposed as relay boxes.

How a network penetration test finds it. Version fingerprinting from outside and, with credentials, authenticated checks inside identify every build and operating system, which the tester maps against KEV and vendor end-of-support dates. An unsupported device is reported as a finding even when no CVE is attached, because the next flaw will not be fixed. Outdated or unpatched software is the largest category in Stingrai's internal network data, at 56.9% of findings.

The fix. Track end-of-support dates in the asset inventory and fund replacements before they arrive, apply KEV-listed patches on a deadline, and isolate anything that cannot yet be replaced: no internet exposure, no route to domain controllers or backups, and logs forwarded off the device.

5. NTLM relay and legacy name resolution

What it is. Windows networks still broadcast name lookups over LLMNR and NetBIOS name service that any host can answer, and still accept NTLM authentication, which an attacker in the middle can capture or relay to another server. Relay works wherever the target does not require SMB signing, LDAP signing and channel binding, or Extended Protection for Authentication on web services such as AD CS web enrollment.

Evidence from 2025 and 2026. CISA added CVE-2025-24054, a Windows NTLM hash disclosure flaw, to KEV on 17 April 2025, and CVE-2025-33073, a Windows SMB client flaw in which a crafted script can "coerce the victim machine to connect back to the attack system using SMB and authenticate," on 20 October 2025. Microsoft's NTLM roadmap of 29 January 2026 lists NTLM's "vulnerability to replay, relay, and pass-the-hash attacks" and says network NTLM will be disabled by default only in the next major Windows Server release. Windows Server 2025 requires SMB signing for outbound connections and LDAP signing for new Active Directory deployments by default, so older and upgraded estates keep the weaker settings.

How attackers use it. From any foothold they answer broadcast name requests or force a server to authenticate to them, then relay that authentication to file servers without SMB signing, to domain controllers over LDAP to create accounts or change delegation, or to certificate enrollment pages to obtain a certificate in the victim's name. Relaying a domain controller's own authentication to a vulnerable enrollment service can lead straight to domain compromise.

How a network penetration test finds it. In an internal test the tester listens passively for LLMNR, NBT-NS and mDNS traffic, enumerates which hosts do not require SMB signing, checks LDAP signing and channel binding on domain controllers and Extended Protection on AD CS web endpoints, and lists the coercion paths that can force a server to authenticate. A controlled relay against an agreed target then proves the impact.

The fix. Turn off LLMNR through Group Policy and NetBIOS over TCP/IP on every interface, require SMB signing on clients and servers, enforce LDAP signing and channel binding on domain controllers, enable Extended Protection or remove HTTP enrollment from AD CS, install the 2025 fixes for both KEV entries, and use Microsoft's NTLM auditing to find and retire the systems that still depend on it.

6. Active Directory and AD CS misconfiguration

What it is. Certificate templates that let a low-privileged user request a certificate for any identity, weak certificate-to-account mappings, service accounts with weak passwords that can be Kerberoasted, excessive ACL rights and dangerous delegation. Each is a path from an ordinary domain account to Domain Admin.

Evidence from 2025 and 2026. In its section on ransomware, Mandiant's M-Trends 2026 says attackers "are exploiting misconfigured Active Directory Certificate Services templates to create admin accounts that bypass password rotation." Amazon found Interlock using Certify, an open-source tool for identifying "vulnerable certificate templates and enrollment permissions," and CISA's Akira advisory lists Kerberoasting among that group's post-exploitation techniques. Microsoft is closing two older weaknesses on a timetable. For CVE-2026-20833, Windows updates from 14 April 2026 make domain controllers assume AES-only support for accounts without an explicit encryption setting, and updates from July 2026 remove the RC4 rollback option. Under KB5014754, domain controllers moved to Enforcement mode for strong certificate mapping on 11 February 2025, and registry support for switching back ended on 9 September 2025.

How attackers use it. With any domain account they enumerate templates, service principal names and permissions, request a certificate as a privileged user or crack a service ticket offline, then follow ACL and delegation paths to Domain Admin. Stingrai's StingAD walkthrough shows that chain, Kerberoasting and AD CS ESC1 included, from one low-privileged credential in a lab domain.

How a network penetration test finds it. An internal or Active Directory penetration test starts from a standard domain user, enumerates certificate templates, enrollment rights and certificate authority settings, lists Kerberoastable accounts and their encryption types, and graphs ACL and delegation paths to privileged groups, then proves the shortest path within agreed limits.

The fix. Remove the enrollee-supplied subject from authentication templates or require manager approval, restrict who can enroll, move service accounts to group managed service accounts or long random passwords, finish the RC4 and strong-mapping changes rather than rolling them back, separate administrative tiers, and monitor certificate issuance for privileged identities.

7. Flat networks and missing segmentation

What it is. Networks where an ordinary workstation can reach servers, domain controllers, hypervisor and backup management, and operational technology on any port. Segmentation does not stop the first compromise; it decides how far it spreads.

Evidence from 2025 and 2026. In advisory AA25-212A of 31 July 2025, CISA reported that during a threat hunt at a US critical infrastructure organization "standard user accounts could directly access the supervisory control and data acquisition (SCADA) virtual local area network (VLAN) directly from IT hosts," and that shared local administrator passwords were stored in plaintext scripts. Google Threat Intelligence Group's zero-day review tells defenders to segment their "DMZ, firewalls, and VPNs" from "critical assets, including the core network and domain controllers." Speed makes this urgent: Mandiant measured the median hand-off from an initial access group to the follow-on group at 22 seconds in 2025, down from more than eight hours in 2022.

How attackers use it. From the first host they scan the internal network, reuse local administrator passwords and reach domain controllers, hypervisor consoles and backup servers directly. Mandiant reports that ransomware operators in 2025 "actively targeted backup infrastructure, identity services, and virtualization management planes."

How a network penetration test finds it. Segmentation testing runs from each zone, such as user VLANs, guest Wi-Fi, the VPN address pool and the DMZ, toward each sensitive zone, confirming which ports and paths are open and which rules actually block. Internal network penetration testing adds the credential side: local administrator reuse and plaintext passwords in scripts and file shares.

The fix. Deny by default between zones, reach management planes, hypervisors and OT only through hardened jump hosts with phishing-resistant MFA, keep backups out of the production domain, give every local administrator account a unique rotated password (CISA points to Microsoft's LAPS), and retest the rules after every network change.

8. Hybrid identity paths from Active Directory to the cloud

What it is. The servers and accounts that connect on-premises Active Directory to Microsoft Entra ID: Entra Connect sync servers, AD FS, synchronized privileged accounts and password hash synchronization. Whoever controls them can often become a cloud administrator.

Evidence from 2025 and 2026. Microsoft's analysis of Storm-0501, published on 27 August 2025, describes an intrusion that moved from domain administrator to an Entra Connect Sync server "that was not onboarded to Defender for Endpoint," then to a synchronized, non-human Global Administrator account that "lacked any registered MFA method." The attackers reset that account's on-premises password, which synchronized to the cloud, registered their own MFA method, and went on to exfiltrate and destroy data and backups in Azure.

How attackers use it. The sync server is a bridge: its Directory Synchronization Account can enumerate the tenant, synchronized privileged users can be taken over by resetting their on-premises passwords, and Global Administrator rights allow persistence through a malicious federated domain, as Storm-0501 set up.

How a network penetration test finds it. An assumed-breach test scoped across Active Directory and Entra ID checks who can log on to sync and federation servers, whether those servers are treated as tier zero, which privileged cloud roles are held by synchronized accounts, and whether every privileged account has strong MFA registered.

The fix. Treat Entra Connect and AD FS servers as tier zero, make Global Administrator and other privileged roles cloud-native accounts "with no ties to on-premises Active Directory," as Microsoft advises, require phishing-resistant MFA for administrators, limit the Directory Synchronization Account with Conditional Access, and enable TPM protection for the sync server's credentials.

9. IPv6 and DNS spoofing

What it is. Windows enables IPv6 and prefers it, so on a network with no IPv6 router any host can announce itself as one with router advertisements, or answer DHCPv6 requests and become every client's DNS server. Name resolution then runs through the attacker, who can redirect traffic or capture and relay authentication.

Evidence from 2025 and 2026. ESET reported on 30 April 2025 that a group it calls TheWizards uses a tool called Spellbinder that sends an IPv6 router advertisement every 200 milliseconds; Windows machines with IPv6 enabled autoconfigure from it and "begin sending IPv6 traffic to the machine running Spellbinder," which the group used to hijack software updates and deliver a backdoor. ESET traces the technique to "a commonly overlooked network misconfiguration of IPv4 and IPv6 coexistence." DNS servers belong on the list too: CISA added CVE-2015-5477, an ISC BIND flaw from 2015 that crashes the server with crafted TKEY queries, to KEV on 8 October 2026.

How attackers use it. The technique penetration testers know as mitm6 takes over DNS through DHCPv6, answers proxy auto-discovery and internal name lookups, and relays the authentication that follows to LDAP or AD CS, which ties this weakness to the relay problem in item 5.

How a network penetration test finds it. In an internal test the tester watches for DHCPv6 and router solicitation traffic, checks whether access switches filter rogue router advertisements and DHCPv6 replies, and, within an agreed window, shows whether clients accept a rogue DNS server. DNS servers are fingerprinted and checked against KEV like any other service.

The fix. Turn on RA Guard and DHCPv6 Guard on access switches. If IPv6 is not in use, block inbound DHCPv6 and router advertisements with host firewall policy rather than unbinding IPv6; Microsoft's IPv6 guidance does not recommend disabling it and suggests preferring IPv4 in prefix policies instead. Disable automatic proxy discovery where nobody needs it, enforce LDAP signing and channel binding, and patch DNS servers.

10. Wi-Fi enterprise misconfiguration

What it is. WPA2- and WPA3-Enterprise networks whose clients do not validate the authentication server's certificate, RADIUS links protected by weak shared secrets, guest networks that can reach corporate systems, and client isolation enforced at only one network layer.

Evidence from 2025 and 2026. AirSnitch, a study by researchers at UC Riverside and KU Leuven presented at the NDSS Symposium in February 2026, found that "every router and network that we tested was affected by at least one" of its client isolation bypasses, across home and enterprise networks. In two real university networks the attacks were "viable in the real world." In an enterprise test bed, the researchers captured the first RADIUS packet sent by an access point, brute-forced the shared passphrase and set up a rogue RADIUS server and access point that "allows any legitimate client to connect, thereby intercepting their traffic and credentials."

How attackers use it. From a parking lot or a guest network, an attacker runs an evil twin access point to collect domain credentials from devices that do not check the server certificate, breaks client isolation to intercept other users' traffic, or crosses from guest Wi-Fi into corporate ranges.

How a network penetration test finds it. A wireless security assessment, on site or remote, surveys every SSID, tests whether clients accept a rogue authentication server, checks client isolation at both the MAC and IP layers, and tests guest-to-corporate segmentation and rogue access point detection.

The fix. Use EAP-TLS with device certificates, or enforce server certificate validation and pinned server names in every supplicant profile; protect the link between access points and RADIUS with long random secrets or RADIUS over TLS; enable WPA3-Enterprise with protected management frames where clients support it; and put guest networks in separate VLANs, which the AirSnitch authors found "effectively nullifies" their attacks on the access point they tested.

Which test finds which vulnerability

For how providers package these tests, what they cost and how to compare proposals, see our guide to network penetration testing services.

Where Stingrai fits

Stingrai is a CREST-accredited penetration testing company, accredited for both Penetration Testing and AI-Enabled Penetration Testing, offering fully human-led and hybrid (human penetration testers plus AI agents) penetration tests, delivered by experienced penetration testers who are also world-class security researchers and bug bounty hunters, with OSCE³, OSWE, OSEP and CREST CRT certifications across the team. Founded in Toronto, Canada in 2021, it is trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA, with engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

Network work is human-led, by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team. Stingrai Inc holds the firm-level accreditation, as its CREST Marketplace profile shows.

• External and internal network testing: Stingrai's network penetration testing covers VPN gateways, firewalls, ADCs and their management interfaces from outside, and lateral movement, privilege escalation and segmentation from inside, black, grey or white box.

• Active Directory: the Active Directory security assessment works through misconfigurations, ACL abuse, Kerberos and delegation paths and AD CS toward Domain Admin, the same tradecraft as the team's open-source StingAD tool.

• Wi-Fi: wireless assessments run on site, or remotely with a Wi-Fi Pineapple.

• Evidence and retest: every confirmed finding, at every severity, is posted to the PTaaS platform the day it is confirmed, retesting of fixed findings is included, and every human-led and hybrid report ships with an attestation letter: penetration testing evidence for your SOC 2, ISO 27001, PCI DSS and HIPAA programs.

Engagements run as one-time annual tests or as continuous programs. Network, Active Directory and wireless work is scoped per engagement; Stingrai's published fixed prices cover one web application and associated APIs only (pricing).

Frequently Asked Questions

What are the top network security vulnerabilities in 2026?

The ten to watch are edge VPN, firewall and gateway exploits; remote access without phishing-resistant MFA; exposed management interfaces and default credentials; end-of-life and unpatched devices; NTLM relay and legacy name resolution; Active Directory and AD CS misconfiguration; flat networks without segmentation; hybrid identity paths from Active Directory to the cloud; IPv6 and DNS spoofing; and Wi-Fi enterprise misconfiguration. The first four decide whether an attacker gets in, and the rest decide how far they get.

What is the most exploited type of network vulnerability right now?

Flaws in internet-facing network and security appliances. Exploitation of vulnerabilities is the most common initial access vector in Verizon's 2026 DBIR, at 31% of breaches with a known vector, and CISA added 81 CVEs from Cisco, Fortinet, Ivanti, Citrix and SonicWall to its Known Exploited Vulnerabilities catalog between January 2025 and 9 November 2026, including an Ivanti Connect Secure exploit chain added on 13 and 30 October 2026.

Why do attackers target VPNs and firewalls so often?

They are reachable from the internet, they handle credentials and sit on trusted network paths, and most cannot run endpoint detection. Google Threat Intelligence Group says the absence of EDR on most edge devices "can create a blind spot for defenders," and Mandiant estimates the mean time to exploit at minus seven days, meaning exploitation often begins before a patch exists.

Does patching a compromised VPN or firewall remove the attacker?

No. A patch closes the vulnerability but not an implant or a stolen secret. In April 2026 CISA and Cisco reported that the actor behind the 2025 ASA campaign had a persistence mechanism preserved across upgrades to the September 2025 fixes, and Google found attackers returning to patched SonicWall appliances with stolen credentials and one-time password seeds. Hunt for compromise first, rebuild from clean firmware if you find any indicator, and rotate every secret the device held.

Which of these vulnerabilities does an external test find, and which need an internal test?

An external network penetration test covers what is reachable from the internet: edge appliance flaws, remote access authentication, exposed management interfaces and unsupported internet-facing devices. NTLM relay, Active Directory and AD CS paths, segmentation, IPv6 and DNS spoofing and hybrid identity paths need an internal or assumed-breach test, and Wi-Fi needs a wireless assessment.

Is NTLM relay still a risk in 2026?

Yes. CISA added two exploited Windows flaws in this area to its KEV catalog in 2025, CVE-2025-24054 (NTLM hash disclosure) and CVE-2025-33073 (SMB client authentication coercion), and Microsoft's January 2026 roadmap disables network NTLM by default only in the next major Windows Server release. Until then, relay depends on configuration: require SMB signing, LDAP signing and channel binding, and Extended Protection on AD CS web enrollment.

Is IPv6 a security risk on a network that only uses IPv4?

Yes, if nothing on the network controls it. Windows enables IPv6 and prefers it, so a rogue router advertisement or DHCPv6 reply can make an attacker the gateway or DNS server, as ESET documented in TheWizards' Spellbinder tool in April 2025. Enable RA Guard and DHCPv6 Guard on switches, or block those messages with host firewall policy, rather than unbinding IPv6, which Microsoft does not recommend.

Related reading

• Network Penetration Testing (2026): Buyer's Guide to Internal, External and Wireless

• Internal Network Penetration Testing: Scope, Cost and What It Actually Finds

• External Network Penetration Testing: What Is In Scope and What It Finds

• Active Directory Penetration Testing Services (2026)

• Citrix NetScaler Zero-Days 2026 (CVE-2026-88771): Compromise Check and Patch Checklist

• WiFi Penetration Testing (2026): Wireless Security Assessment Scope, Cost and Methodology

• StingAD: From One Low-Priv Account to Domain Admin

• The State of Penetration Testing 2026

Talk to Stingrai

Want these ten checked on your own network? Stingrai scopes external, internal, Active Directory and wireless tests with a retest, as a one-time annual engagement or a continuous program. Get a quote.