Active exploitation of PAN-OS CVE-2024-3400 and Ivanti Connect Secure auth bypass chain drives midweek incident surge

Security teams entered Wednesday contending with ongoing exploitation of Palo Alto Networks PAN-OS CVE-2024-3400 and Ivanti Connect Secure CVE-2023-46805 and CVE-2024-21887 on internet facing VPN and firewall appliances. Intrusions frequently progress from device compromise to theft of credentials and tokens, which are then used for lateral movement into cloud and SaaS accounts.

This matters now because fixes are widely available and many organizations are scheduling midweek maintenance, but appliances that were exposed before patching can remain compromised. Teams that apply updates without hunting for persistence and rotating downstream secrets risk repeat access through stolen sessions.

H2: What is being exploited

CVE-2024-3400 is a command injection flaw in the GlobalProtect feature of PAN-OS that has been exploited in the wild, initially by the actor Palo Alto tracks as UTA0218. Successful exploitation grants code execution on the device, often followed by deployment of simple web shells, cron based persistence, log tampering, and credential harvesting from configuration stores.

Ivanti Connect Secure has seen broad exploitation of an authentication bypass, CVE-2023-46805, commonly paired with command injection CVE-2024-21887. Attackers use the bypass to reach privileged endpoints, execute commands, plant web shells in appliance storage, and backdoor integrity checks. Multiple actor sets, including espionage focused groups and financially motivated intruders, have used these bugs to collect passwords and intercept session material that unlocks access to identity providers and SaaS tenants.

H2: Mitigation path

Apply vendor fixes immediately and treat previously exposed devices as potentially compromised. For PAN-OS and Ivanti appliances, collect forensic snapshots, review recent file modifications and scheduled tasks, and inspect for unknown binaries or scripts. Check outbound connections from the management plane and compare against documented baselines.

Rotate all local and downstream credentials associated with the appliance. Regenerate device certificates, rotate SAML signing keys where applicable, revoke OAuth refresh tokens, and force reauthentication to invalidate stolen cookies and cloud sessions. Reset VPN user passwords and enforce phishing resistant MFA.

Constrain exposure by restricting portal access by source IP, disabling unused features, and segregating management interfaces from the internet. Add detections for common exploit and web shell patterns on these platforms. If compromise is suspected, rebuild from known good images rather than relying on file level cleanup.

Edge devices remain a high value entry point that bridges network and identity, so resilience now depends on rapid patching paired with identity centric remediation. Vendors will face continued pressure to deliver immutable appliance builds with verifiable state and to expose better telemetry so defenders can detect and evict quietly persistent access.