Zero-day on a VPN gateway
A vendor publishes a critical advisory for its VPN gateway, with no patch. Your logs show exploitation predating the advisory. Analyze, prioritize and produce an alert for your sector.
Briefing
Thursday, October 22, 2026, 6 pm: Velia Networks publishes advisory VELIA-SA-2026-07 for SecureGate, the VPN gateway used by your hospital group (Alveane Regional Hospital). A critical vulnerability is being exploited “in a limited way”. A patch is announced within 10 days. You are the on-call CTI analyst. You have the advisory, the web logs of the exposed gateway and the equipment inventory.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Spot the exploitation in the logs
- Understand what exploitation before the advisory implies
- Order the response actions
- Prioritize the exposed fleet
- Share the information with the right TLP marking
Tools used in real investigations
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.