Security researchers have discovered a critical zero-day vulnerability (CVE-2026-1234) in a widely-used enterprise VPN solution that affects approximately 15,000 organisations globally, including several in Hong Kong.

The vulnerability exists in the VPN client’s authentication module and could allow an attacker to bypass authentication entirely, gaining access to the protected internal network. The issue has been assigned a CVSS score of 9.8 (Critical).

“We are aware of active exploitation in the wild,” the vendor stated in an emergency advisory. “All users should update to the latest version immediately.”

HKISG recommends that organisations:

  1. Update VPN software to the latest patched version as a priority
  2. Enable multi-factor authentication as an additional layer of protection
  3. Monitor network logs for suspicious authentication patterns
  4. Consider implementing a VPN kill switch for mobile devices

The vulnerability highlights the importance of regular software updates and defence-in-depth strategies for network security.

Hong Kong operator checklist

  1. Confirm whether the systems, vendors, or practices described apply to your estate.
  2. Assign an owner and a review date — do not leave findings as unread newsletter content.
  3. Capture evidence (configs, tickets, screenshots) if you later enter a Trust Review.
  4. Brief leadership with a dated one-page note when residual risk remains high.

What “good” looks like

  • Controls are operated, not only documented
  • Privileged access uses phishing-resistant MFA where feasible
  • Detection and response paths are exercised at least annually
  • Third-party dependencies have an owner and an exit plan

Sources and further reading

Editorial note

This page is published by the Hong Kong Information Security Group (HKISG) for educational and early-warning purposes. It is not a substitute for legal advice, formal audit opinions, or national CERT coordination.

Frequently asked questions

Who should read this?

Security, IT, and risk owners in Hong Kong organisations who need practical context rather than marketing claims.

Does this change any public HKISG rating?

No. TrustScores are produced only through the published Trust Review / Awards process. Reading this page does not alter scores.

How often is this content reviewed?

HKISG dates publications and retains corrections under our editorial standards. Check the updated field in the page header when present.