Midweek triage zeroes in on edge appliances as attackers keep exploiting PAN-OS CVE-2024-3400 and FortiOS CVE-2024-21762

Security teams are prioritizing edge devices on Wednesday, focusing on Palo Alto Networks PAN-OS CVE-2024-3400 and Fortinet FortiOS CVE-2024-21762, both listed by CISA as known exploited. Adversaries continue to use these flaws for initial access on internet exposed gateways, then move laterally into corporate networks.

This matters now because Patch Tuesday changes often land without immediate downtime for security appliances, leaving exploitable windows midweek. Telemetry from community sources such as Shadowserver and GreyNoise has shown persistent scanning for these classes of bugs, and functional exploits are in public circulation.

Active exploitation of edge devices

CVE-2024-3400 is an OS command injection in PAN-OS when GlobalProtect is enabled on specific versions. Threat activity observed in 2024 included actors writing scheduled tasks, dropping lightweight bash or Python stagers, harvesting configuration and credential material from the device, and disabling logs to blunt incident response. Unit 42 previously attributed early zero day exploitation to a cluster it tracks as UTA0218, with follow on activity that targeted internal Windows infrastructure.

CVE-2024-21762 is a FortiOS SSL VPN remote code execution vulnerability that has been exploited in the wild. Intruders commonly deploy web shells on FortiGate appliances, create or modify local admin accounts, and relay stolen VPN credentials to authenticate as valid users. From there, they enumerate Active Directory, move to file servers and hypervisors, and stage data theft or encryption.

Chinese nexus operators such as UNC3886 have a track record of working through network and virtualization appliances with minimal malware and heavy use of living off the land. Ransomware affiliates have adopted similar playbooks, using compromised gateways to push tooling like Cobalt Strike or custom loaders, then leveraging native Windows utilities for discovery and lateral movement.

Mitigation path

Apply vendor fixes to all affected PAN-OS and FortiOS versions, then validate that GlobalProtect and SSL VPN services match hardened configuration guidance. If patching is delayed, disable the impacted services where feasible, restrict management and portal exposure with ACLs, and enforce MFA tied to device posture.

Assume compromise if an unpatched device was internet reachable. For PAN-OS, review configuration diffs, cron and systemd timers, unusual processes on the management plane, and unexpected outbound connections. For FortiGate, check for unauthorized local users, modified VPN settings, unexpected files under web root directories, and anomalous sessions on the SSL VPN. Rotate administrative credentials and certificates, revoke tokens, and rebuild appliances if integrity is in doubt.

Network segmentation and egress controls that limit appliance initiated traffic reduce blast radius when edge devices are hit. The broader trend is clear, attackers continue to favor long lived appliance weaknesses, so enterprises need operational muscle to patch network and VPN gateways as quickly as they treat browser or email client bugs.