Friday patch watch: Edge appliance CVEs with active exploits still expose enterprises
Marcus Webb ·
Vendors and agencies often publish security advisories late on Fridays to limit attention, which can leave defenders exposed over the weekend. Teams should prioritize checks on three still high impact edge vulnerabilities that continue to drive intrusions, Citrix NetScaler ADC and Gateway CVE-2023-4966, Fortinet FortiOS and FortiProxy CVE-2023-27997, and Palo Alto Networks PAN-OS GlobalProtect CVE-2024-3400. All three have confirmed exploitation in the wild and vendor fixes available.
These flaws matter because they sit on the network perimeter and enable unauthenticated access or code execution, which attackers use to establish footholds before moving laterally. CISA’s Known Exploited Vulnerabilities catalog has listed each, and incident responders continue to find them in initial access chains across ransomware and espionage cases.
Impacted systems and severity CVE-2023-4966, widely known as CitrixBleed, affects supported and end of life versions of NetScaler ADC and Gateway. Successful exploitation enables session hijacking and credential theft, which can lead to full administrative control. Exploit tools are public, and unpatched appliances remain common in scans.
CVE-2023-27997 is a heap based buffer overflow in FortiOS SSL VPN that allows pre authentication remote code execution. Fortinet published fixes and detection guidance, but compromised edge devices are still being observed in incident triage, often with webshells or backdoor services installed for persistence.
CVE-2024-3400 is a command injection flaw in PAN-OS GlobalProtect on specific configurations. It was exploited prior to full patch availability, and Palo Alto Networks shipped hotfix releases and threat signatures. Organizations that applied mitigations but deferred version upgrades should complete patching.
Patches and weekend actions Verify your estate against the vendor advisories for each product family, then patch to the latest fixed builds. For NetScaler, invalidate all active sessions after updating and rotate administrative credentials. For FortiOS, audit for unauthorized local users, scheduled tasks, and suspicious files under appliance file systems. For PAN-OS, confirm the running release includes the hotfix level that addresses CVE-2024-3400 and remove any persistence artifacts.
Restrict external management interfaces, enforce MFA for remote access, and check logs for indicators of compromise published by the vendors and CISA. If patching must wait, apply mitigations and increase monitoring on these devices through the weekend.
The broader issue is the persistent concentration of risk at internet facing middleboxes. Late week advisories will continue, so enterprises need pre approved emergency change windows, tested rollback plans, and automated inventory to shrink the gap between disclosure and remediation on the edge.