Patching is not closing

Summary

The vendor’s fix closes the flaw for anyone who arrives later. An intruder who came in before it keeps passwords, live sessions and files planted on the box. In NPA’s 2025 survey, 31 of 71 victims said the device they were entered through was fully patched.

The intruder’s access outlives the patch in five ways

Source: National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153); Fortinet PSIRT Malicious Actor Discloses FortiGate SSL-VPN Credentials; JPCERT/CC JPCERT/CC Incident Handling Report: July 1, 2024 - September 30, 2024 (p.14); Mandiant (Google Cloud) Investigation of Session Hijacking via Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966); Fortinet PSIRT Analysis of Threat Actor Activity; MIVD and AIVD (Netherlands), published by NCSC-NL Ministry of Defence of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT (p.1, p.2 §3.1; p.1 (Wayback Machine capture of the NCSC-NL PDF of 2024-02-06; ncsc.nl no longer serves it)); CISA ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices (Background; Background; V1 update 2026-04-23); CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B); Google Cloud (Mandiant) Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation; JPCERT/CC 「Ivanti Connect Secureなどにおける脆弱性（CVE-2025-0282）に関する注意喚起」 (JPCERT-AT-2025-0001, updated 2025-02-13)

1. Credentials stolen before the patch

CVE-2018-13379 let anyone read the FortiOS SSL-VPN session file, with user names and passwords, without logging in. In September 2021 Fortinet reported that access information for 87,000 FortiGate SSL-VPN devices had been disclosed, and warned: “While they may have since been patched, if the passwords were not reset, they remain vulnerable.” Handa Hospital’s address, ID and password were in that dump (technical volume, printed p.10). JPCERT/CC reported the same in 2024 with CVE-2023-27997 and CVE-2024-21762: products that already had the fix applied, entered with credentials stolen before it.

2. Sessions stolen before the patch

CitrixBleed (CVE-2023-4966) leaked memory that could hold a valid session cookie issued after multi-factor authentication (MFA). According to Mandiant, a valid cookie is enough to establish a session “without knowledge of the username, password, or access to a multi-factor authentication token or device.” Upgrading does not end those sessions; NetScaler’s notice adds to the upgrade: “In addition, we also recommend killing all active and persistent sessions”. LockBit 3.0 affiliates used the bug (AA23-325A).

3. Persistence that survives upgrades

In April 2025 Fortinet described a symbolic link that attackers had left in the SSL-VPN file tree on devices compromised through earlier bugs. It gave read-only access to the file system, configuration included, “even if the customer device was updated with FortiOS versions that addressed the original vulnerabilities”. The Dutch MIVD and AIVD wrote of the FortiGate implant COATHANGER: “It survives reboots and firmware upgrades.” CISA’s ED 25-03 describes Cisco ASA attackers “manipulating read-only memory (ROM) to persist through reboot and system upgrade” and later added that the required updates do “not necessarily remove an existing threat actor from the compromised device.” On Ivanti Connect Secure, Mandiant found malware that blocks the upgrade “while giving the appearance of a successful upgrade”.

4. Integrity checks that are fooled

Ivanti’s Integrity Checker Tool (ICT) checks whether the appliance’s files have been altered. CISA reported in AA24-060B that “Ivanti’s internal and previous external ICT failed to detect compromise.” Mandiant notes a limit of design: “The ICT does not scan for malware or other Indicators of Compromise.”

5. Compromise before disclosure

“Mandiant has identified zero-day exploitation of CVE-2025-0282 in the wild beginning mid-December 2024.” Ivanti disclosed it on 2025-01-08. JPCERT/CC confirmed several Japanese victims from late December 2024, before disclosure (JPCERT-AT-2025-0001). CitrixBleed was exploited from late August 2023 and disclosed on 2023-10-10. CISA’s BOD 26-04 now pairs its three-day remediation tier with an order to “carry out a forensic triage of the asset to assess whether the system is compromised.”

A KEV entry for your appliance: the order of work

Preservation comes first because every later step changes the box.

Source: CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B); Fortinet PSIRT Analysis of Threat Actor Activity; NetScaler (Cloud Software Group) CVE-2023-4966: Critical security update now available for NetScaler ADC and NetScaler Gateway; JPCERT/CC JPCERT/CC Incident Handling Report: July 1, 2024 - September 30, 2024 (p.14); CISA BOD 26-04: Prioritizing Security Updates Based on Risk

1. Preserve. Export the configuration and every local log, and capture memory if your incident-response provider can. The evidence page lists what each step erases.
2. Patch. Upgrade from an image downloaded from the vendor, not from files already on the appliance. If your model has no fixed version, apply the vendor’s mitigation or take the portal offline, and schedule the replacement.
3. Reset every credential the box touched (table below). CISA: “Reset all credentials that may have been exposed during the compromise”.
4. Revoke active and persistent VPN sessions and issued tokens.
5. Hunt behind the box. Look for administrator or VPN accounts you did not create, logons to domain controllers and servers from VPN address pools, and RDP or SMB sessions from the appliance’s internal address. CISA on Ivanti: once compromise is suspected, “assume that threat actors hold full administrative access”.
6. Rebuild if in doubt. Factory reset or reinstall, then restore a configuration you have reviewed line by line. Fortinet: “Treat all configuration as potentially compromised”. On Ivanti even a factory reset was not proof (step 4 above), so rotate credentials again afterwards.
7. Report to the vendor, JPCERT/CC, the police, and any regulator your sector or the data involved requires.

Every credential the box touched

CISA tells Ivanti customers to “assume that user and service account credentials stored within the affected Ivanti VPN appliances are likely compromised.” Mandiant found the appliance’s cache could contain “VPN sessions, session cookies, API keys, certificates, and credential material”.

Source: CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B); Google Cloud (Mandiant) Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation; JPCERT/CC 「Fortinet製品に関連する認証情報の漏えいに関する注意喚起」 (JPCERT-AT-2026-0019); SonicWall 「Gen 7 and newer SonicWall Firewalls – SSLVPN Recent Threat Activity」; NetScaler (Cloud Software Group) CVE-2023-4966: Critical security update now available for NetScaler ADC and NetScaler Gateway