EDGE INFRASTRUCTURE UNDER SIEGE: WHAT TWO INDEPENDENT DATASETS REVEAL ABOUT WHO'S EXPLOITING YOUR PERIMETER

Summary from the TLDR InfoSec newsletter

A joint analysis by Tenable and SentinelOne revealed that state-sponsored groups and ransomware operators are independently exploiting the same edge device vulnerabilities. Researchers identified 12 flaws with confirmed multi-nexus exploitation by evaluating 93 CVE attribution pairs, including critical bugs in PAN-OS GlobalProtect (CVE-2024-3400) and Check Point Quantum (CVE-2024-24919). The underlying exposure data highlights severe remediation bottlenecks across major enterprise vendors. F5 appliances led exposure rates with 54 percent of customer environments carrying an actively exploited CVE, while Citrix deployments suffered a median patch time of 461 days. Additionally, Ivanti edge products demonstrated a predictable pattern of serial exploitation refreshing every 8.5 to 13 months. Security teams must prioritize patching F5 and Citrix appliances immediately while deploying feature set minimization and strict endpoint protections to block lateral movement following a perimeter breach.