Chapter 3S=1:100S=1:5
The doors
31 flaws attackers have used in VPN appliances from seven vendors: FortiGate, Ivanti Connect Secure, Citrix NetScaler (CitrixBleed), SonicWall and more.
Summary
The door schedule on this page lists 31 flaws in the VPN appliances of seven vendors, each confirmed by CISA as used by attackers. 29 of them can be reached before anyone logs in, and for most of those a strong password and multi-factor authentication (MFA) never come into play.
19 were used before the vendor published a warning. For 17, the vendor or a government agency says the patch alone was not enough: stolen passwords, sessions or implants outlasted it.
A door facing the internet
A VPN appliance is a door for staff who work outside the office, and it accepts connections from the whole internet.
On the internet all day
Anyone can try it at any hour. At Handa Hospital, the investigators found no limit on which addresses could connect: every system on the internet could reach the appliance.
Source: Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 技術編」 (printed pp.9–11, 14–15; pp.10–14)
The intercom answers before anyone logs in
Before the lock asks for a password, the appliance serves a login page, images, language files and single sign-on endpoints. That code is the intercom. A flaw in it needs no account.
It opens behind reception
The UK NCSC writes that these devices “often sit at trust boundaries”.
Source: NCSC (UK) Making forensic observability the norm for network devices
One flaw in the frame is enough
An office server can be watched with security software and its logs collected elsewhere. On most VPN appliances neither is possible.
| Part | Office server | VPN appliance |
|---|---|---|
| Security agent (EDR) | Installed and reporting | “EDR tools are not usually equipped to work on these products” (Google) |
| Logs | Sent to a central store | Often kept only on the box. Volexity found an appliance whose “logs had been wiped and logging had been disabled” |
| Integrity check | Agent and file checks | The vendor tool for Ivanti appliances “failed to detect compromise” (CISA) |
| Damage from one bug | Usually one service | Root on the box, which holds VPN passwords and directory credentials |
Source: Google Threat Intelligence Group Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation AnalysisVolexity Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPNSophos It takes two: The 2025 Sophos Active Adversary Report (2024 case data)CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)
Old code with full control of the box
Google’s analysis of 2024 zero-days notes that these products seldom need a chain of bugs: one flaw can “single-handedly” give remote code execution. Many rows in the schedule are buffer overflows, a class of bug that memory-unsafe languages such as C allow; CISA and the FBI cite CVE-2025-0282 as an example.
Source: Google Threat Intelligence Group Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation AnalysisCISA and FBI Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities (p.1)CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)
No security agent runs on it
Volexity describes these systems as ones that “cannot run traditional security software”.
Source: Volexity Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN
The camera records little
Logs on the appliance are short, rotate quickly and can be erased by an intruder with root. Sophos found logs missing in 47% of the 2024 cases in its 2025 report.
Source: Sophos It takes two: The 2025 Sophos Active Adversary Report (2024 case data)
Late patches and unsupported appliances
Attackers
Defenders
Source: Verizon 2025 Data Breach Investigations Report: Executive Summary (p.6)CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories)watchTowr Labs Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)
An update takes remote work offline
Updating the appliance stops remote work while it restarts, so updates get postponed. Verizon found that only about 54% of edge-device and VPN flaws were fully fixed within the year, with a median of 32 days. In Japan, NPA’s survey found that 52% of organizations using VPN appliances had not applied the latest patch.
Source: Verizon 2025 Data Breach Investigations Report: Executive Summary (p.6)National Police Agency 「サイバー攻撃の被害に係る企業・団体を対象としたアンケート調査結果及び対策」 (p.1)
Doors past end of support
An appliance past end of support keeps working with no more fixes. CISA, the FBI and the UK NCSC warn that state actors use these devices “as entry points to access modern, supported environments”. At Osaka General Medical Center, the entry appliance had never been updated: before the emergency upgrade it ran FortiOS 5.4.2 (the committee’s summary gives 5.4.8).
Source: CISA, FBI and NCSC-UK Reducing the Attack Surface for End-of-Support Edge Devices (p.1; pp.1–2)Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)
A pre-auth flaw never meets the lock
MFA is part of the lock and stops someone who arrives with a stolen password. A flaw in the intercom or the frame is used before the lock is consulted, so MFA does not come into it.
29 of the 31 flaws in the schedule take the red route.
Exploitation often starts before the advisory
- CVE-2019-11510exploited +120 d · KEV +924 d
- CVE-2018-13379exploited +92 to +122 d · KEV +917 d
- CVE-2019-19781 Shitrixexploited +15 to +45 d · KEV +687 d
- CVE-2021-20016exploited −21 to −1 d · KEV +285 d
- CVE-2021-22893exploited −1 d or earlier · KEV +197 d
- CVE-2022-42475exploited −72 to −42 d · KEV +1 d
- CVE-2023-27997 XORtigateexploited −11 to +18 d · KEV +1 d
- CVE-2023-3519exploited −47 to −18 d · KEV +1 d
- CVE-2023-20269exploited −189 to −159 d · KEV +7 d
- CVE-2023-4966 CitrixBleedexploited −70 to −40 d · KEV +8 d
- CVE-2023-46805exploited −40 to −10 d · KEV 0 d
- CVE-2024-21762exploited −7 to +21 d · KEV +1 d
- CVE-2024-3400exploited −17 d · KEV 0 d
- CVE-2024-24919exploited −51 d · KEV +2 d
- CVE-2024-40766exploited −21 to +9 d · KEV +18 d
- CVE-2024-53704exploited +25 to +52 d · KEV +42 d
- CVE-2025-0282exploited −38 to −8 d · KEV 0 d
- CVE-2025-22457exploited −33 to −3 d · KEV +1 d
- CVE-2025-5777 CitrixBleed 2exploited −16 to +13 d · KEV +23 d
- CVE-2025-6543exploited −55 to −25 d · KEV +5 d
- CVE-2025-7775exploited −25 to −1 d · KEV 0 d
- CVE-2025-20362exploited −117 d or earlier · KEV 0 d
- CVE-2026-24858exploited −7 d · KEV 0 d
- CVE-2026-3055exploited +4 d · KEV +7 d
- CVE-2026-0257exploited +4 d · KEV +16 d
- CVE-2026-50751exploited −32 d · KEV 0 d
- CVE-2026-15409exploited −1 d or earlier · KEV 0 d
- CVE-2026-104935exploited −10 d · KEV 0 d
zero-day exploitationexploitation after disclosure (a month-only date is drawn as a range)added to KEV (an arrow at the right edge means after day 120)
Source: CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories)
Data
| CVE | Disclosed | First exploited | Days from disclosure | KEV added | Disclosure to KEV |
|---|---|---|---|---|---|
| CVE-2019-11510 | 2019-04-24 | 2019-08-22: mass scanning began the day after a public exploit appeared | +120 d | 2021-11-03 | +924 d |
| CVE-2018-13379 | 2019-05 | August 2019, after a public conference talk (day not confirmed) | +92 to +122 d | 2021-11-03 | +917 d |
| CVE-2019-19781 Shitrix | 2019-12-17 | January 2020, after exploit code circulated around 2020-01-10; firmware fixes came 2020-01-19 to 01-24 | +15 to +45 d | 2021-11-03 | +687 d |
| CVE-2021-20016 | 2021-01-22 | January 2021, used as a zero-day | −21 to −1 d | 2021-11-03 | +285 d |
| CVE-2021-22893 | 2021-04-20 | Before 2021-04-20, as a zero-day (start not confirmed) | −1 d or earlier | 2021-11-03 | +197 d |
| CVE-2022-42475 | 2022-12-12 | October 2022, at least two months before disclosure (MIVD) | −72 to −42 d | 2022-12-13 | +1 d |
| CVE-2023-27997 XORtigate | 2023-06-12 | June 2023; Fortinet said it 'may have been exploited in a limited number of cases' (date not confirmed) | −11 to +18 d | 2023-06-13 | +1 d |
| CVE-2023-3519 | 2023-07-18 | June 2023, as a zero-day at a critical-infrastructure organization (CISA) | −47 to −18 d | 2023-07-19 | +1 d |
| CVE-2023-20269 | 2023-09-06 | From March 2023, brute-force campaigns (Rapid7, via secondary; date not confirmed) | −189 to −159 d | 2023-09-13 | +7 d |
| CVE-2023-4966 CitrixBleed | 2023-10-10 | Late August 2023, as a zero-day (Mandiant) | −70 to −40 d | 2023-10-18 | +8 d |
| CVE-2023-46805 | 2024-01-10 | December 2023, as a zero-day (UNC5221 / UTA0178) | −40 to −10 d | 2024-01-10 | 0 d |
| CVE-2024-21762 | 2024-02-08 | February 2024; the vendor said 'potentially exploited' at disclosure (date not confirmed) | −7 to +21 d | 2024-02-09 | +1 d |
| CVE-2024-3400 | 2024-04-12 | 2024-03-26 first test attempts; working exploitation seen 2024-04-10 (Volexity) | −17 d | 2024-04-12 | 0 d |
| CVE-2024-24919 | 2024-05-28 | 2024-04-07, as a zero-day (Check Point, revised from 04-30) | −51 d | 2024-05-30 | +2 d |
| CVE-2024-40766 | 2024-08-22 | August or September 2024 (date not confirmed) | −21 to +9 d | 2024-09-09 | +18 d |
| CVE-2024-53704 | 2025-01-07 | February 2025, shortly after a proof of concept was published on 2025-02-10 | +25 to +52 d | 2025-02-18 | +42 d |
| CVE-2025-0282 | 2025-01-08 | Mid-December 2024, as a zero-day (Mandiant); Japanese victims from late December (JPCERT/CC) | −38 to −8 d | 2025-01-08 | 0 d |
| CVE-2025-22457 | 2025-04-03 | Mid-March 2025, against boxes without the 2025-02-11 fix; the attackers 'likely studied the patch' (Mandiant) | −33 to −3 d | 2025-04-04 | +1 d |
| CVE-2025-5777 CitrixBleed 2 | 2025-06-17 | Mid to late June 2025, before public proofs of concept (date not confirmed) | −16 to +13 d | 2025-07-10 | +23 d |
| CVE-2025-6543 | 2025-06-25 | Early May 2025, as a zero-day against Dutch organizations (NCSC-NL) | −55 to −25 d | 2025-06-30 | +5 d |
| CVE-2025-7775 | 2025-08-26 | August 2025, already exploited at disclosure (date not confirmed) | −25 to −1 d | 2025-08-26 | 0 d |
| CVE-2025-20362 | 2025-09-25 | May 2025 or earlier, as a zero-day (ArcaneDoor) | −117 d or earlier | 2025-09-25 | 0 d |
| CVE-2026-24858 | 2026-01-27 | 2026-01-20, as a zero-day (customer reports, via secondary) | −7 d | 2026-01-27 | 0 d |
| CVE-2026-3055 | 2026-03-23 | By 2026-03-27, four days after disclosure, from known threat-actor addresses (watchTowr honeypots) | +4 d | 2026-03-30 | +7 d |
| CVE-2026-0257 | 2026-05-13 | 2026-05-17 (Rapid7, via secondary) | +4 d | 2026-05-29 | +16 d |
| CVE-2026-50751 | 2026-06-08 | 2026-05-07, as a zero-day (Rapid7) | −32 d | 2026-06-08 | 0 d |
| CVE-2026-15409 | 2026-07-14 | Before 2026-07-14, as a zero-day (Rapid7 MDR, via Tenable) | −1 d or earlier | 2026-07-14 | 0 d |
| CVE-2026-104935 | 2026-10-13 | 2026-10-03, as a zero-day (Volexity) | −10 d | 2026-10-13 | 0 d |
KEV is CISA’s Known Exploited Vulnerabilities catalog, which started on 2021-11-03; that is why the KEV tick for older flaws sits far to the right. Rows chained behind another flaw are drawn once, under the first flaw of the chain.
Technical detail
The door, by its real parts
| Part | Component | What failure looks like | Rows in the schedule |
|---|---|---|---|
| Intercom | Pre-auth web portal | File read, memory read or overflow reached with no session | 19 |
| Lock | Authentication, MFA, SAML, IKE | Authentication bypass, missing authorization, password guessing | 11 |
| Issued keys | Session tokens, stored credentials | Tokens leaked from memory, credential files read, sessions hijacked or forged | 9 |
| Frame and hinges | Appliance OS, daemons, management interface | Code execution as root, implants, admin login | 17 |
| Camera | Appliance logs | Log entries removed after exploitation | 2 |
A row can pass through more than one part, so the counts add up to more than 31.
Door schedule: 31 flaws in seven product lines
One door mark per product line (SD-1 to SD-7), one row per flaw. Every row is in CISA KEV (catalog version 2026.10.23). Each row has its own link, for example #cve-2023-4966.
Showing 31 of 31
Selected: CVE-2023-4966 CitrixBleed · Pre-auth web portal → Session tokens and stored credentials
| CVE | Part that fails | What the attacker gets | KEV added | Patch alone closes it? |
|---|---|---|---|---|
| SD-1 Fortinet FortiGate (FortiOS SSL-VPN) | ||||
| NVD · KEV | Intercom → Issued keysPre-auth | The SSL-VPN session file, with usernames and plaintext passwords, without logging in | 2021-11-03Ransomware: Known | No Passwords read before the patch keep working until they are reset; 87,000 devices' credentials were published in 2021 |
| ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | Code execution on the firewall without logging in | 2022-12-13Ransomware: Known | No The COATHANGER implant survives reboots and firmware upgrades (MIVD/AIVD) |
| ||||
| XORtigateNVD · KEV | Intercom → Frame and hingesPre-auth | Code execution without logging in | 2023-06-13Ransomware: Known | No Fortinet named it among the entry points for a symlink left behind after updating to fixed versions |
| ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | Code execution without logging in | 2024-02-09Ransomware: Known | No Fortinet named it among the entry points for a symlink left behind after updating to fixed versions |
| ||||
| NVD · KEV | Lock → Frame and hingesPre-auth | Admin login to other customers' devices with FortiCloud SSO enabled; admin accounts created, configurations taken | 2026-01-27Ransomware: Unknown | No report says otherwise |
| ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | On a device compromised earlier, files read through the leftover symlink despite the cleanup patch | 2026-07-27Ransomware: Unknown | No Only matters after an earlier compromise; FortiOS 7.2, 7.0 and 6.4 have no fix in their branch and must migrate |
| ||||
| SD-2 Ivanti Connect Secure (formerly Pulse Connect Secure) | ||||
| NVD · KEV | Intercom → Issued keysPre-auth | Files including cached plaintext credentials and session data, without logging in | 2021-11-03Ransomware: Known | No CISA: attackers kept access after patching where stolen credentials were not changed |
| ||||
| NVD · KEV | Lock → Frame and hingesPre-auth | Code execution without logging in | 2021-11-03Ransomware: Known | No report says otherwise |
| ||||
| NVD · KEV | LockPre-auth | Restricted resources without logging in; chained with CVE-2024-21887 for root-level commands | 2024-01-10Ransomware: Known | No CISA ordered agencies to disconnect, factory-reset and rebuild; persistence may survive factory resets |
| ||||
| NVD · KEV | Lock → Frame and hingesChained behind CVE-2023-46805 | Command execution; needs admin access alone, none when chained behind CVE-2023-46805 | 2024-01-10Ransomware: Known | No Same directive and advisory as CVE-2023-46805: rebuild and treat linked accounts as compromised |
| ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | Code execution without logging in | 2025-01-08Ransomware: Known | No Mandiant: the malware faked a successful upgrade and copied itself into the new partition during a real one |
| ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | Code execution without logging in | 2025-04-04Ransomware: Known | No report says otherwise |
| ||||
| NVD · KEV | Lock → Frame and hinges → CameraPre-auth | Root-level code execution on a fully patched appliance when chained; logs were tampered with | 2026-10-13Ransomware: Unknown | No At disclosure one bug in the chain (privilege escalation) still had no fix |
| ||||
| SD-3 Citrix NetScaler ADC / Gateway | ||||
| ShitrixNVD · KEV | Intercom → Frame and hingesPre-auth | Code execution on the appliance without logging in | 2021-11-03Ransomware: Known | No report says otherwise |
| ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | Code execution without logging in; a web shell was planted | 2023-07-19Ransomware: Known | No report says otherwise |
| ||||
| CitrixBleedNVD · KEV | Intercom → Issued keysPre-auth | A valid session cookie issued after MFA, so the session works without username, password or MFA | 2023-10-18Ransomware: Known | No Sessions stolen before the patch kept working after it; active sessions had to be killed |
| ||||
| CitrixBleed 2NVD · KEV | Intercom → Issued keysPre-auth | Session tokens from memory, so sessions can be hijacked past MFA | 2025-07-10Ransomware: Known | No Patching left stolen sessions valid; active sessions had to be terminated |
| ||||
| NVD · KEV | Intercom → Frame and hinges → CameraPre-auth | Code execution in practice; web shells planted and traces erased | 2025-06-30Ransomware: Unknown | No NCSC-NL: updating does not remove access an attacker already gained |
| ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | Code execution or denial of service without logging in (Gateway and AAA setups) | 2025-08-26Ransomware: Unknown | No report says otherwise |
| ||||
| NVD · KEV | Intercom → Issued keysPre-auth | Appliance memory, possibly including admin session IDs, without logging in (SAML IdP setups only) | 2026-03-30Ransomware: Unknown | No report says otherwise |
| ||||
| SD-4 Palo Alto Networks GlobalProtect (PAN-OS) | ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | Code execution on the firewall without logging in | 2024-04-12Ransomware: Known | No report says otherwise |
| ||||
| NVD · KEV | Issued keysPre-auth | A VPN connection without valid credentials, so MFA is never asked (needs a non-default feature) | 2026-05-29Ransomware: Known | No report says otherwise |
| ||||
| SD-5 SonicWall SonicOS SSLVPN and SMA | ||||
| NVD · KEV | Intercom → Issued keysPre-auth | Usernames, passwords and session information, without logging in | 2021-11-03Ransomware: Known | No report says otherwise |
| ||||
| NVD · KEV | LockPre-auth | Unauthorized access to firewall resources; used for SSLVPN initial access by ransomware groups | 2024-09-09Ransomware: Known | No SonicWall: in 2025 local passwords carried over in migrations and never reset were still being used |
| ||||
| NVD · KEV | Lock → Issued keysPre-auth | A logged-in user's SSL VPN session, bypassing password and MFA, and a tunnel into the network | 2025-02-18Ransomware: Known | No report says otherwise |
| ||||
| NVD · KEV | Intercom → Frame and hingesPre-auth | Internal-only services without logging in; with CVE-2026-15410, root code execution | 2026-07-14Ransomware: Known | No report says otherwise |
| ||||
| SD-6 Cisco ASA / FTD remote access VPN | ||||
| NVD · KEV | LockPre-auth | Valid VPN username and password pairs by brute force; it does not bypass MFA where MFA is enforced | 2023-09-13Ransomware: Known | No report says otherwise |
| ||||
| NVD · KEV | LockPre-auth | Restricted VPN web endpoints without logging in; chained with CVE-2025-20333 | 2025-09-25Ransomware: Unknown | No CISA: the actor modified ROM to persist through reboot and upgrade; updates do 'not necessarily remove' it |
| ||||
| NVD · KEV | Lock → Frame and hingesChained behind CVE-2025-20362 | Code execution as root; needs VPN credentials alone, none when chained behind CVE-2025-20362 | 2025-09-25Ransomware: Unknown | No CISA: the actor modified ROM to persist through reboot and upgrade; updates do 'not necessarily remove' it |
| ||||
| SD-7 Check Point Quantum Security Gateway (Remote Access VPN) | ||||
| NVD · KEV | Intercom → Issued keysPre-auth | Files such as local account password hashes, without logging in | 2024-05-30Ransomware: Known | No Check Point's remediation includes resetting local and LDAP passwords |
| ||||
| NVD · KEV | LockPre-auth | A remote-access VPN session without a valid password (deprecated IKEv1 setups only) | 2026-06-08Ransomware: Known | No report says otherwise |
| ||||
Source: CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories)
“Ransomware: Unknown” is CISA’s own value and means CISA has not linked the flaw to a ransomware campaign; it does not mean “no”. “No report says otherwise” in the last column means only that none of the cited sources asks for more than the patch. It is not a promise that patching is enough. CVE-2026-8452 is left out because its score and first exploitation could not be confirmed from a primary source.
29 of 31 need no password
- SD-1 Fortinet FortiGate (FortiOS SSL-VPN)6 of 6
- SD-2 Ivanti Connect Secure (formerly Pulse Connect Secure)6 of 7
- SD-3 Citrix NetScaler ADC / Gateway7 of 7
- SD-4 Palo Alto Networks GlobalProtect (PAN-OS)2 of 2
- SD-5 SonicWall SonicOS SSLVPN and SMA4 of 4
- SD-6 Cisco ASA / FTD remote access VPN2 of 3
- SD-7 Check Point Quantum Security Gateway (Remote Access VPN)2 of 2
reachable before loginneeds a login alone, used chained behind a pre-auth flaw
Source: CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories)Volexity Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)CVE Program CVE-2025-0282 (Description)
The two outlined squares, CVE-2024-21887 and CVE-2025-20333, each need a login on their own. Attackers used them behind a pre-auth flaw (CVE-2023-46805 and CVE-2025-20362), so in practice the chain needed no login. CVE-2024-3400 is “unauthenticated remote code execution” in Volexity’s words. The CVE record for CVE-2025-0282 describes “a remote unauthenticated attacker”.
A stolen session is already past MFA
After the lock opens, the appliance hands the user a session cookie and keeps a copy in memory. CitrixBleed (CVE-2023-4966) and CitrixBleed 2 (CVE-2025-5777) are bugs at the intercom that return pieces of that memory, cookies included.
| Step | Employee | Attacker |
|---|---|---|
| 1 | Enters a password at the lock | — |
| 2 | Answers the MFA prompt | — |
| 3 | The appliance issues a session cookie and keeps it in memory | |
| 4 | Works through the VPN | Sends requests to the intercom; the memory-read bug returns the cookie |
| 5 | — | Presents the cookie. The appliance treats it as a logged-in session |
Source: Mandiant (Google Cloud) Investigation of Session Hijacking via Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966)CISA, FBI, MS-ISAC, ASD's ACSC #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)
Mandiant: with a valid cookie an attacker has a session “without knowledge of the username, password, or access to a multi-factor authentication token or device”. CISA and the FBI tied CitrixBleed to LockBit 3.0 affiliates. SonicWall’s CVE-2024-53704 reaches the same result through an authentication bypass, and in CVE-2026-0257 the appliance trusted forged authentication-override cookies. A cookie issued before the patch still works on the patched appliance until the session is ended. Tenable’s FAQ on CitrixBleed 2 repeats Citrix’s advice to terminate active sessions after updating.
Source: Mandiant (Google Cloud) Investigation of Session Hijacking via Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966)CISA, FBI, MS-ISAC, ASD's ACSC #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)Tenable CVE-2025-5777, CVE-2025-6543: Frequently Asked Questions About CitrixBleed 2 and Citrix NetScaler Exploitation
Leaked passwords outlive the patch
A flaw that reads files at the intercom often hands over the usernames and passwords stored on the box. Patching stops new reads; passwords already copied keep working.
| Date | Event |
|---|---|
| 2019-05 | Fortinet fixes CVE-2018-13379, a pre-auth file read that exposes the SSL-VPN session file with plaintext passwords |
| 2020-11-27 | JPCERT/CC warns that a list of affected hosts has been published and recommends changing passwords “even if already addressed” |
| 2021-09-08 | Fortinet: SSL-VPN access information for 87,000 FortiGate devices has been disclosed. Upgraded devices “may remain vulnerable post-upgrade” without a password reset |
| 2021-10-31 | Handa Hospital is hit by ransomware. The investigators confirm the leaked data included the hospital’s address, ID and password |
Source: Fortinet PSIRT Malicious Actor Discloses FortiGate SSL-VPN CredentialsJPCERT/CC 「Fortinet 社製 FortiOS の SSL VPN 機能の脆弱性 (CVE-2018-13379) の影響を受けるホストに関する情報の公開について」Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 技術編」 (printed pp.9–11, 14–15; pp.10–14)
CISA wrote in 2020 that attackers with stolen Pulse Secure credentials could still move through a network “after the organization has patched”, if the credentials were not changed. In 2025 SonicWall traced a wave of intrusions to CVE-2024-40766 and to cases “where local user passwords were carried over during the migration and not reset”. Check Point’s remediation for CVE-2024-24919 includes password resets.
Source: CISA Continued Threat Actor Exploitation Post Pulse Secure VPN Patching (AA20-107A)SonicWall 「Gen 7 and newer SonicWall Firewalls – SSLVPN Recent Threat Activity」Help Net Security Check Point VPN zero-day exploited since beginning of April (CVE-2024-24919)
Implants survive the upgrade
What an intruder adds to the appliance is not always removed by an upgrade.
| Product | What stayed | What it survived | Said by |
|---|---|---|---|
| FortiGate | A symbolic link in the SSL-VPN language-file folder giving read-only access to the file system | Updating to FortiOS versions that fixed the original flaws (CVE-2022-42475, CVE-2023-27997, CVE-2024-21762). In 2026 CVE-2025-68686 bypassed the cleanup | Fortinet, 2025-04-10 and FG-IR-25-934 |
| FortiGate | COATHANGER remote access trojan | Reboots and firmware upgrades; “even fully patched FortiGate devices may therefore be infected” | MIVD and AIVD, 2024-02-06 |
| Ivanti Connect Secure | Root-level persistence; web shells the integrity checker missed | Factory resets, according to CISA’s lab research | CISA AA24-060B |
| Ivanti Connect Secure | SPAWNANT and PHASEJAM malware | A real upgrade (copied into the new partition), or a faked one shown to the admin | Mandiant, 2025-01-09 |
| Cisco ASA | Modified ROM | “reboot and system upgrade” | CISA ED 25-03 |
| Citrix NetScaler | Access gained through CVE-2025-6543, web shells | The update; NCSC-NL says an attacker can keep earlier access | NCSC-NL, 2025-08-13 |
Source: Fortinet PSIRT Analysis of Threat Actor ActivityFortinet PSIRT SSL-VPN Symlink Persistence Patch Bypass (FG-IR-25-934)MIVD and AIVD (Netherlands), published by NCSC-NL Ministry of Defence of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT (p.1, p.2 §3.1; p.1 (Wayback Machine capture of the NCSC-NL PDF of 2024-02-06; ncsc.nl no longer serves it))CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)Google Cloud (Mandiant) Ivanti Connect Secure VPN Targeted in New Zero-Day ExploitationCISA ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices (Background; Background; V1 update 2026-04-23)NCSC (Netherlands) Casus: Citrix kwetsbaarheid
For the Ivanti flaws, CISA’s Emergency Directive 24-01 had federal agencies disconnect the appliances, factory-reset and rebuild them, revoke and reissue every certificate, key and password on them, and treat linked domain accounts as compromised.
Source: CISA ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities (Supplemental Direction V2)
The gap is days, and often negative
The fastest case after disclosure: watchTowr saw CVE-2026-3055 exploited from known attacker addresses “as of March 27th”, four days after Citrix published it. For CVE-2025-22457, Ivanti shipped a fix on 2025-02-11 as an ordinary bug fix; Mandiant assesses that the attackers “likely studied the patch” and were exploiting unpatched appliances by mid-March. CISA gave federal agencies one day to deal with CitrixBleed 2.
| Measure | Rows |
|---|---|
| Exploited before the vendor disclosed it (zero-day) | 19 |
| Added to KEV, as exploited, on the disclosure day | 11 |
| Patch alone not enough, per the cited source | 17 |
| KEV ransomware field “Known” | 23 |
| All rows | 31 |
Source: CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories)watchTowr Labs Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)Mandiant (Google Cloud) Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)BleepingComputer CISA tags Citrix Bleed 2 as exploited, gives agencies a day to patch
Replacement products are edge software too
Zero-trust network access (ZTNA) products are often sold as the replacement for the VPN. A stolen login then reaches one application at a time instead of the whole network, but the gateway is still software on the internet edge.
| Product | Affected before version | Role |
|---|---|---|
| Ivanti Connect Secure | 22.7R2.5 | SSL VPN |
| Ivanti Policy Secure | 22.7R1.2 | Network access control |
| Ivanti Neurons for ZTA gateways | 22.7R2.3 | ZTNA gateway |
Source: CVE Program CVE-2025-0282 (Description)Google Cloud (Mandiant) Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation
The record describes one stack-based buffer overflow across all three products, reachable by “a remote unauthenticated attacker”.