Three stories closed the week of June 22 with the same structure. An attacker accessed a network security appliance, operated inside it for an extended period, and was discovered only when someone outside the victim’s security team stumbled onto the evidence.

FortiBleed ran from at least February 2026 through mid-June: four months of active credential harvesting from internet-facing FortiGate firewalls before researcher Volodymyr Diachenko found the attacker’s exposed server hosting a validated credential database alongside a 45-GPU hash-cracking cluster. By the time CISA issued its emergency advisory on June 18, the confirmed device count had reached 86,644 across 194 countries. Cisco’s seventh SD-WAN zero-day of 2026, CVE-2026-20245, was exploited at a service provider for at least two months before Cisco’s public disclosure, confirmed by Google Cloud threat intelligence and Mandiant. The flaw allowed a netadmin-privileged attacker to upload a crafted CSV file and execute commands as root; the attacker created a backdoor account named “troot,” then ran specific anti-forensic scripts before departing. A third incident, the Qilin-linked VPN zero-day CVE-2026-50751, has now been confirmed at six weeks of pre-disclosure dwell time from the W25 tracking period.

Four months. Two months. Six weeks. Three independent campaigns. Three different products, from three different vendors. The same structural outcome: the advisory arrived after the attacker had already finished.

The security industry consistently frames pre-disclosure exploitation as a patching failure. The vendor should have discovered the bug sooner. The defender should have patched faster. This analysis is correct and it is also insufficient, because it locates the problem in the wrong place.

The patch resolves a specific code vulnerability. It does not address the access that preceded the advisory. A credential harvested from a FortiGate in March remains valid after the June patch is applied. A backdoor account created on a Cisco SD-WAN management plane in April still exists after the advisory, if no one specifically searched for it. And in none of these three cases did the victim’s monitoring system detect the attacker before the advisory cycle: the FortiBleed discovery came through an exposed threat-actor server found by an external researcher, the SD-WAN compromise was documented through incident response at a third party, and the VPN zero-day surfaced through campaign attribution from external intelligence. The victim’s security operations contributed nothing to the discovery timeline.

This is not a patching failure. It is a detection architecture failure.

Perimeter appliances sit at the boundary of the network, but their management planes typically receive less behavioral monitoring than the endpoint fleet they protect. Windows Event logs feed SIEM correlation rules with high fidelity. Firewall configuration changes, new administrative accounts, anomalous CLI command patterns, outbound connections from management interfaces, these are not surfaces most security operations centers watch with the same granularity. That gap is where FortiBleed operated for four months and where the Cisco SD-WAN attacker managed its persistent access for two.

The Cisco SD-WAN case is worth sitting with. After gaining root access, the threat actor created a persistent backdoor account, then ran log-erasure scripts targeting the specific forensic artifacts that a later investigation would look for. This is not opportunistic exploitation. The attacker reasoned explicitly about the forensic investigation that would eventually follow and took action to defeat it before departing. That behavior requires understanding the defender’s response methodology well enough to anticipate what investigators would examine. The attacker extended their operational timeline by modeling the defender’s detection timeline, not by avoiding triggering any alert in real time.

Three consecutive weeks of Fortinet incidents add another dimension. FortiBleed’s credential harvesting campaign is not the only active Fortinet targeting this cycle. FortiClient EMS exploitation (tracked since W25) and FortiSandbox OS command injection (CVE-2026-39808) both have confirmed activity this week. Three distinct Fortinet product lines under active targeting simultaneously is not a coincidence of unrelated bugs. It is a campaign against an ecosystem. Organizations treating each Fortinet advisory as an isolated patch event are missing the operational pattern: the attacker is covering the management client, the sandbox appliance, and the firewall credential infrastructure in parallel.

Cisco’s SD-WAN situation has its own accumulation problem. CVE-2026-20245 is the seventh exploited zero-day in the Catalyst SD-WAN Manager product family in 2026, one roughly every three to four weeks. Six prior patches have not prevented the next disclosure. The architectural exposure is the management plane’s internet accessibility, not any individual implementation flaw. A patch recommendation at the seventh zero-day in a single calendar year is not sufficient guidance.

Where This Goes

The perimeter appliance pre-disclosure exploitation pattern now has three confirmed data points with dwell times between six weeks and four months. That is enough to treat it as a confirmed class, not a coincidence. The behavioral implication for defenders follows directly.

First, treat the patch advisory as a trailing indicator of compromise for any internet-exposed perimeter appliance, not as a trigger for patch-and-continue operations. FortiGate environments with internet exposure since February should initiate full credential rotation before relying on patching alone, because the patch does not invalidate harvested credentials. Cisco SD-WAN environments should search specifically for unexpected administrative accounts and review configuration change logs from at least April forward.

Second, reframe the coverage question for perimeter appliance management planes. The question is not whether the patch SLA was met. The question is: if an attacker accessed this device two months ago, what would the evidence look like, and are we collecting it? CLI audit logs, administrative account creation events, configuration changes outside change-management windows, and anomalous outbound connections from management interfaces should feed security monitoring with the same priority as endpoint EDR telemetry.

Third, recalibrate the attacker time advantage. If the pre-disclosure dwell time is 60 days and the post-advisory patch SLA is 30 days, the attacker’s minimum advantage is 90 days before any defensive action begins. That calculation changes the risk model for any organization with internet-exposed network security infrastructure, and it makes “we patched within SLA” an incomplete statement of remediation.

The advisory cycle is a useful tool. It is not a detection system. Organizations that treat advisory feeds as their primary signal for perimeter appliance compromise are operating on the attacker’s preferred timeline.

Security Unlocked publishes weekly threat intelligence and strategic analysis. This post is based on intelligence collected June 22 - June 28, 2026.