Wednesday briefing: active exploits target Palo Alto CVE-2024-3400 and Ivanti CVE-2024-21887 on internet exposed VPN edges

Active exploitation of two widely exposed edge device flaws, Palo Alto Networks PAN OS CVE-2024-3400 and Ivanti Connect Secure CVE-2024-21887, is driving fresh compromises this week across North America and Europe. Victims report initial access through these internet facing VPN portals, followed by credential theft and lateral movement inside Windows and cloud environments.

This is not a new disclosure. Both vulnerabilities have been public and under active exploitation since 2024, and proof of concept code remains easy to obtain. Wednesday continues to concentrate new breach notifications because many enterprises defer appliance patching to weekend windows and attackers race the lag.

How the intrusion chains work

CVE-2024-3400 is a command injection in the GlobalProtect feature of PAN OS that grants device level code execution to an unauthenticated attacker. Adversaries drop webshells, create high privilege local users, and pull configurations to harvest service account credentials. From there they tunnel RDP and SMB, deploy Cobalt Strike or Sliver, and in some cases stage ransomware.

Ivanti compromises typically chain CVE-2023-46805, an authentication bypass, with CVE-2024-21887, a command injection. The pair yields root level access on the appliance. China nexus groups earlier used the chain for espionage, and multiple ransomware affiliates later adopted the same playbook. Post exploitation often includes dumping session data, replaying valid credentials, and granting malicious OAuth consent to maintain access to Microsoft 365.

What defenders should do now

Patch to fixed builds, then validate device integrity. For PAN OS, update to vendor specified fixed versions and search for unknown admin accounts, modified startup scripts, and unexpected web content under management interfaces. For Ivanti Connect Secure and Policy Secure, apply the mitigation package or fixed firmware, integrity check the appliance, and if tampering is suspected, perform a factory reset and rebuild from a clean image.

Assume credential compromise. Rotate any accounts used for device administration, revoke OAuth tokens and refresh tokens in Microsoft 365 and Google Workspace, invalidate VPN sessions, and enforce multifactor authentication with phishing resistant methods. Monitor for outbound connections from appliances, add rules to block new administrative portals from the internet, and place VPN appliances behind conditional access and client certificate validation where possible.

The sustained pressure on edge appliances underscores a broader shift. Security programs are moving away from unmanaged internet exposed boxes toward managed services, automated patch pipelines, and identity centric access controls that reduce the blast radius when perimeter devices fail.