Wednesday triage: attackers still exploiting Citrix Bleed, Ivanti Connect Secure, and PAN-OS CVE-2024-3400

Security operations teams on Wednesday are prioritizing active exploitation paths into perimeter gear, including Citrix NetScaler ADC and Gateway vulnerable to CVE-2023-4966, Ivanti Connect Secure and Policy Secure appliances, and Palo Alto Networks PAN-OS devices affected by CVE-2024-3400. Intrusions continue to pivot from these devices into domain controllers and cloud tenants, resulting in data theft and ransomware deployment.

This matters now because these flaws sit on the edge, they are reachable from the internet, and they remain in CISA’s Known Exploited Vulnerabilities catalog. Attackers, from ransomware crews to state linked actors, have repeatedly shown they can move from appliance access to full enterprise compromise in hours if patches and hardening are incomplete.

Edge device exploitation remains the fastest path in

Citrix Bleed, CVE-2023-4966, enables session hijacking that grants administrative access without credentials. Ransomware groups including LockBit and ALPHV previously weaponized it to steal credentials and push encryptors to Windows and ESXi estates, a playbook that defenders still observe against unpatched instances.

Ivanti Connect Secure campaigns have used chained flaws such as CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 to achieve command execution and persist via malicious plugins and modified integrity checks. Incident responders continue to find web shell residue and modified system files on appliances that were patched but never rebuilt.

PAN-OS CVE-2024-3400 is a command injection in GlobalProtect portal configurations that was exploited in the wild to run arbitrary commands as root. Successful attackers harvest device configs and credentials, then stage lateral movement through SSH, PsExec, or scheduled tasks to reach identity providers and backup infrastructure.

Mitigation and detection that work mid week

For Citrix ADC and Gateway, apply fixed builds cited in the vendor advisory, invalidate all active sessions, and rotate secrets stored on the appliance. Monitor for anomalous new sessions without corresponding logins and for sudden increases in VPN virtual server traffic.

For Ivanti Connect Secure and Policy Secure, perform a factory reset or clean rebuild using known good images, then import a sanitized configuration, not a direct backup. Remove persistence by validating file integrity, deleting unauthorized plugins, and rotating LDAP, RADIUS, SAML, and local admin credentials.

For PAN-OS, apply the security update for your train, audit GlobalProtect portal and gateway configurations, and review system logs for unexpected command execution. Rotate service account passwords, API keys, and SAML certificates that were ever stored on the device.

Across all edge devices, restrict management interfaces to dedicated admin networks or VPN, disable unnecessary SSO trust, and enforce FIDO2 backed MFA on downstream services. Hunt for post exploitation activity, including new service creations, NTDS.dit access attempts, LSASS memory reads, and suspicious OAuth grants.

Identity abuse is the parallel front. Tenants should require admin consent workflows, limit third party app consent to verified publishers, and monitor Microsoft 365 audit logs for high risk consent grants and elevated service principals. Conditional Access that requires phishing resistant MFA for OAuth sensitive scopes reduces blast radius.

For the wider technology landscape, the pattern is clear, appliances remain high value ingress and identity is the prize. Vendors and enterprises need shorter patch cycles for edge software, secure by default configurations that bind management to private interfaces, and tighter cloud app consent models that treat OAuth scopes with the same rigor as privileged credentials.