Wednesday surge highlights continued exploitation of Ivanti and Citrix edge bugs for initial access
Marcus Webb ·
Security teams working through Wednesday disclosures are prioritizing intrusions that begin on vulnerable edge appliances, notably Ivanti Connect Secure and Citrix NetScaler. Attackers are still exploiting CVE-2023-46805 and CVE-2024-21887 on Ivanti for pre authentication command execution, and CVE-2023-4966 on NetScaler to steal session tokens, with ransomware affiliates including LockBit operators and Scattered Spider linked crews observed using these paths in recent campaigns. The persistence of these vectors reflects exposed management planes and incomplete patching across global enterprises.
The Citrix Bleed flaw enables immediate session hijack, which bypasses multifactor authentication and grants internal access as a valid user. The Ivanti chain enables code execution on the gateway, the placement of persistent web shells, and credential theft that often leads to domain compromise.
How the intrusions unfold
On Ivanti appliances, attackers chain the authentication bypass with command injection, deploy web shells and reverse tunnels, add unauthorized admin accounts, and schedule cron tasks for persistence. They then harvest credentials and cookies from the device, pivot to internal Windows hosts, abuse living off the land tools like PowerShell and WMI, and target Active Directory Certificate Services to escalate privileges.
On NetScaler, threat actors extract valid session tokens from memory, replay them to assume user and administrator identities, and move laterally to hypervisors, VDI brokers, and file servers. Multiple groups have combined these entry points with cloud identity abuse, including creating malicious OAuth apps in Microsoft 365 with offline access and Files or Mail scopes to maintain access even after password resets.
Mitigation priorities
Apply vendor fixed builds for Ivanti Connect Secure and Citrix NetScaler, then perform non negotiable post patch actions. For NetScaler, revoke all active sessions on the gateway, invalidate tokens, and force user reauthentication. For Ivanti, run the latest Integrity Checker Tool, investigate for unauthorized files and users, and if compromise is confirmed, rebuild the device and rotate credentials.
Constrain management interfaces to dedicated admin networks, require certificate based admin access, and monitor for configuration changes on appliances. In Microsoft 365, disable user consent to apps, require admin consent workflows, and review service principals with high privilege Graph or Exchange scopes. Monitor sign in logs for impossible travel with valid tokens, unusual OAuth consent grants, and creation of new service principals.
If domain compromise is suspected, rotate high value secrets including krbtgt in sequence, purge cached credentials on appliances, and reissue device and VPN certificates. Enforce phishing resistant MFA, segment edge gateways from critical systems, and run continuous external attack surface management to detect exposed devices.
The continued success of edge device exploits underscores that appliances function as unmanaged workloads, not static perimeter gear, which pushes enterprises toward tighter lifecycle control, firmware attestation, and identity aware access in place of legacy VPN dependence.