For engineersS=1:5
The pre-auth surface
Everything an SSL-VPN does before it knows who is asking is open to the internet. Most of the worst VPN bugs live there, often giving full control.
Summary
Before anyone logs in, the appliance already handles TLS, the web request, the login page, the files it loads and SAML messages. Anyone on the internet can send it that traffic. A flaw in this code needs no password, and multi-factor authentication (MFA) never sees the request.
Technical detail
One request through the appliance
The appliance terminates TLS, then a web daemon reads the request and hands it to a handler. On FortiOS that daemon is sslvpnd, the process Fortinet names in its advisory for CVE-2022-42475 (FG-IR-22-398). Everything in the shaded zone runs at this point. The password, second factor and SAML assertion are checked only after it.
Of the 31 KEV-listed VPN and remote-access CVEs in the door schedule, 29 are reachable before login. The other 2 were exploited in the wild chained behind one that is.
Source: Fortinet PSIRT Heap-based buffer overflow in sslvpnd (FG-IR-22-398, Indicators of Compromise)CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories)
Bug classes
Pre-auth code has to accept input from anyone, so it cannot rely on account limits or on who the sender is. In most SSL-VPN products the same web stack serves the login page and the logged-in portal.
Memory corruption is the largest group: buffer overflows, out-of-bounds reads and writes, one use-after-free. These bugs occur in memory-unsafe languages such as C and C++. CISA and the FBI list CVE-2025-0282 (Ivanti Connect Secure) and CVE-2023-6549 (Citrix NetScaler) as examples: “Threat actors frequently exploit these vulnerabilities to gain initial access to an organization’s network and then move laterally to the wider network.” That much of this code is old C inside one large web daemon is this site’s inference from the bug classes and from lineages such as Pulse Secure to Ivanti; vendors do not publish it.
Source: CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories)CISA and FBI Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities (p.1)
Data
| Class | CVEs | IDs |
|---|---|---|
| Memory corruption | 12 | CVE-2022-42475, CVE-2023-27997, CVE-2024-21762, CVE-2021-22893, CVE-2025-0282, CVE-2025-22457, CVE-2023-4966, CVE-2025-5777, CVE-2025-6543, CVE-2025-7775, CVE-2026-3055, CVE-2025-20333 |
| Authentication or authorization bypass | 9 | CVE-2026-24858, CVE-2023-46805, CVE-2026-104935, CVE-2026-0257, CVE-2024-40766, CVE-2024-53704, CVE-2023-20269, CVE-2025-20362, CVE-2026-50751 |
| Injection (command, code, SQL, SSRF) | 5 | CVE-2024-21887, CVE-2023-3519, CVE-2024-3400, CVE-2021-20016, CVE-2026-15409 |
| File read or path traversal | 5 | CVE-2018-13379, CVE-2025-68686, CVE-2019-11510, CVE-2019-19781, CVE-2024-24919 |
That every appliance runs this code as root is an inference. The table lists only cases where the vendor or CISA stated the privilege.
| CVE | Product | Pre-auth | What the advisory says |
|---|---|---|---|
| CVE-2024-3400 | PAN-OS GlobalProtect | yes | “may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall” |
| CVE-2025-20333 | Cisco ASA and FTD VPN web server | chained with CVE-2025-20362 | “A successful exploit could allow the attacker to execute arbitrary code as root” |
| CVE-2023-46805, CVE-2024-21887 and later | Ivanti Connect Secure | yes (chained) | CISA, AA24-060B: an actor “may be able to gain root-level persistence despite issuing factory resets” |
Source: Palo Alto Networks CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectCisco PSIRT Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerability (cisco-sa-asaftd-webvpn-z5xP8EUB)CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)
Inventory the exposure
Only addresses and names that belong to you. Do not scan addresses you do not control, and get written permission before scanning a range a provider or vendor operates for you.
| Method | What it tells you | What it misses |
|---|---|---|
| Asset register and contracts | Every internet-facing device, including boxes a vendor installed for remote maintenance. Osaka was entered through a catering vendor’s appliance (p.45). | Devices nobody recorded |
| A scan of your own public IP ranges, by you or a contracted tester | Which ports answer, and which product and version the portal or TLS certificate reveals | Addresses outside the ranges you listed |
| Exposure search engines (Shodan, Censys) queried for your own ranges and domains | What outside scanners have already indexed about you, with history | Anything they have not crawled yet |
| Certificate transparency logs for your domains | Host names such as vpn.example[.]com that someone set up and forgot |
Devices that use only an IP address |
| Vendor support portal | Model, serial number and the date support ends | Devices registered to a former contractor |
Source: Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)CISA, FBI and NCSC-UK Reducing the Attack Surface for End-of-Support Edge Devices (p.1; pp.1–2)
Cutting the surface down
None of these changes fixes a vulnerable handler that stays enabled, so patching still applies.
Source: Canadian Centre for Cyber Security Security considerations for edge devices (ITSM.80.101) (ITSM.80.101)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 技術編」 (printed pp.9–11, 14–15; pp.10–14)JPCERT/CC 「Fortinet製FortiOSの境域外書き込みの脆弱性（CVE-2024-21762）に関する注意喚起」 (JPCERT-AT-2024-0004, IV. 回避策)
| Change | What leaves the pre-auth zone | Basis |
|---|---|---|
| Move the management interface to a separate management network | The administrative web UI and its API | CCCS: NMIs “should not be directly exposed to the Internet.” |
| Allow the portal only from known source addresses, where users connect from fixed sites | Every handler, for everyone outside the list | Handa’s appliance: “インターネット上のすべてのシステムからの接続が可能であった。” (technical volume, printed p.11). Fits partner and site-to-site access better than mobile workers. |
| Disable features you do not use: clientless web mode, unused SSO integrations, legacy protocol versions | The code behind those features | CCCS: “Deactivate any functionality that is not required.” CVE-2026-24858 affected only devices with FortiCloud SSO enabled. |
| As a stopgap during an unpatched KEV, disable the SSL-VPN function | The whole portal | JPCERT/CC on CVE-2024-21762: “SSL VPN機能を無効にすることで本脆弱性の回避が可能です。” |