Retiring the Remote Access VPN: A Phased Plan for Small Businesses

Briefing

In one week of October 2026, CISA added flaws in Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Fortinet products and BeyondTrust Remote Support to the Known Exploited Vulnerabilities catalog. All four product lines exist to let people in from outside. CISA reported that the Ivanti flaw, CVE-2026-104935, was used as a zero-day to execute commands without logging in.

Two properties make a traditional VPN a recurring target. It accepts connections from the whole internet, and a successful login usually lands the user on the internal network with broad reach. A stolen VPN credential is a common first step toward ransomware.

Zero trust, as described in NIST SP 800-207 and CISA's Zero Trust Maturity Model, grants access per request based on user, device and application. Zero-trust network access (ZTNA) puts that into practice with an outbound connector and a broker, which removes the inbound listener entirely. CISA and its partners recommended moving in this direction in their 2024 joint guide on network access security.

What to do

1. Week 1: inventory remote use. Record each application people reach from outside and who uses it.
2. Week 2: clean up identity. Unique accounts, MFA everywhere, starting with email and administrators, and same-day disablement for departures.
3. Week 3: set device rules. Decide which managed devices can reach which applications.
4. Weeks 4 and later: move applications to ZTNA one at a time, highest value first, with the VPN still available as a fallback during the switch.
5. Final step: shut down the VPN and close the firewall port. The risk is only removed when the listener is gone.
6. Interim: until the VPN is retired, patch KEV entries on it as emergencies, restrict portal access, require MFA, and check for compromise after patching.

How to verify

• An external scan of your public addresses should show no VPN service.
• Access logs should record user, device, application and time for every session.
• Your managed platform (Ares RMM for our clients) should show patch and protection status for each device with access.

Sources

• CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog, Oct 13, 2026
• CISA, CISA Adds Four Known Exploited Vulnerabilities to Catalog, Oct 14, 2026
• CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog, Oct 16, 2026
• CISA, CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure, Oct 13, 2026
• NIST SP 800-207, Zero Trust Architecture
• CISA, Zero Trust Maturity Model
• CISA and partners, Modern Approaches to Network Access Security (2024)
• CISA, BOD 26-04: Prioritizing Security Updates Based on Risk

Want help putting this in place? Contact Computer Plus.