# Edge Infrastructure Under Siege: Tenable and SentinelOne Datasets Reveal Convergent Nation-State and Criminal Exploitation of Perimeter Devices

> A joint Tenable Research Special Operations / SentinelOne Incident Readiness & Response analysis cross-references exposure telemetry (238 high-priority CVEs across thousands of customer containers) against 12 months of DFIR casework (66 CVEs) to build an 82-CVE, 93 CVE-actor-attribution-pair dataset spanning ~39 named threat actors. Datasets converge on 79% of the same vendor attack surfaces despite only 21% CVE-level overlap, and 12 CVEs show confirmed multi-nexus attribution where state-sponsored and financially motivated actors independently exploit the same edge-device vulnerability.

- **Published:** 2026-08-26T00:00:00Z
- **Last reviewed:** 2026-08-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2153
- **ID:** TL-2026-2153
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2023-42793, CVE-2024-3400, CVE-2024-24919, CVE-2025-59718, CVE-2026-24858, CVE-2024-47575, CVE-2023-34133, CVE-2023-34132, CVE-2023-34124, CVE-2024-8963, CVE-2024-8190, CVE-2025-59719, CVE-2026-15410

## Description

Tenable Research Special Operations and SentinelOne Incident Readiness & Response combined two independently collected datasets — Tenable's exposure-management telemetry across thousands of customer containers and SentinelOne's 12-month DFIR casework spanning 66 CVEs — into an 82-distinct-CVE, 93-CVE-actor-attribution-pair corpus covering roughly 39 named threat actors across five nexus categories (China, Russia, Iran, DPRK, and financially motivated/ransomware). Despite only 21% CVE-level overlap between the two sources, the datasets converge on 79% of the same vendor attack surfaces, with full agreement on seven edge/remote-access vendors: Fortinet, Citrix, Ivanti, Palo Alto Networks, Cisco, Juniper, and VMware.

The report's core finding is convergent exploitation: 12 CVEs show confirmed multi-nexus attribution, where state-sponsored and financially motivated actors independently weaponize the same perimeter-device vulnerability rather than exclusively targeting it. Documented examples include CVE-2026-15409 (SonicWall SMA1000 SSRF), first exploited by the Volexity-tracked cluster UTA0533 for credential harvesting and subsequently weaponized en masse by INC Ransomware; CVE-2023-42793 (JetBrains TeamCity authentication bypass), independently exploited by Russia-nexus APT29/Cozy Bear and DPRK-nexus Lazarus Group; CVE-2024-3400 (PAN-OS GlobalProtect command injection), exploited as a zero-day by China-nexus UTA0218 to deploy the custom Python backdoor UPSTYLE and later reused by INC Ransomware; and CVE-2024-24919 (Check Point Quantum Gateway information disclosure), independently exploited by the China-nexus cluster PurpleHaze and the Iran-nexus, government-attributed actor Fox Kitten (Pioneer Kitten) to extract local-account password hashes for lateral movement.

Beyond the anchor CVEs, the corpus documents a Fortinet-specific chain: CVE-2024-47575 ("FortiJump," a missing-authentication flaw in the FGFM device-registration daemon fgfmsd) let an actor register an unauthorized device to a FortiManager instance, retrieve managed-device configurations and FortiOS256-hashed credentials, and remain undetected for roughly a month; and CVE-2025-59718/CVE-2026-24858, a SAML-signature-verification bypass in FortiCloud SSO that let attackers authenticate as legitimate SSO users and create rogue local administrator accounts on fully patched FortiGate firewalls, forcing Fortinet to ship a server-side (cloud-infrastructure) fix rather than a client patch. A parallel SonicWall GMS/Analytics chain (CVE-2023-34133 SQL injection, CVE-2023-34132 pass-the-hash, CVE-2023-34124 authentication bypass) let an actor create administrative accounts on a managed-service-provider console and pivot into multiple downstream customer environments, with resulting traffic assessed as click-fraud infrastructure abuse. A China-nexus actor separately chained the pre-disclosure Ivanti Cloud Services Appliance flaws CVE-2024-8963 (path traversal) and CVE-2024-8190 (OS command injection) to bypass admin authentication, execute code as root, and collect SSH keys and stored credentials for post-exploitation — later documented in the joint CISA/FBI advisory AA25-022A.

Exposure telemetry shows the highest container-level exposure on F5 (53.8% of monitored environments) and Citrix (28.8%), with Citrix also carrying the slowest remediation (461-day median time to patch; 71% of affected environments still unpatched after one year). High-priority CVEs across the combined Tenable list take a median of 146 days to remediate versus 122 days for lower-priority CVEs — a statistically significant 24-day gap — and only 54% of edge-device Known Exploited Vulnerabilities are fully remediated fleet-wide. Ivanti products show a structural "serial exploitation" pattern: EPMM averages roughly 8.5 months and Connect Secure roughly 13 months between successive exploited CVEs, which the report characterizes as a refreshing pipeline rather than isolated incidents. Actor density correlates with exposure: Fortinet (29 distinct actors across 5 nexus categories), Citrix (22 actors), and Ivanti (19 actors) are the most broadly targeted vendors in the corpus.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1136.001 Create Account: Local Account
- T1136.002 Create Account: Domain Account
- T1505.003 Server Software Component: Web Shell
- T1606.002 Forge Web Credentials: SAML Tokens
- T1090.003 Proxy: Multi-hop Proxy
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1021 Remote Services
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols

## Sources

- [Edge Infrastructure Under Siege: What Two Independent Datasets Reveal About Who's Exploiting Your Perimeter](https://www.sentinelone.com/blog/what-two-independent-datasets-reveal-about-whos-exploiting-your-perimeter/)
- [SonicWall CVE-2026-15409 and CVE-2026-15410 zero-day exploited](https://www.tenable.com/blog/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the)
- [Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858](https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026)
- [Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications (AA25-022A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-022a)
- [Palo Alto Networks Releases Guidance for Vulnerability in PAN-OS, CVE-2024-3400](https://www.cisa.gov/news-events/alerts/2024/04/12/palo-alto-networks-releases-guidance-vulnerability-pan-os-cve-2024-3400)
- [Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices](https://www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/)
- [From WSProxy to Root: INC ransomware and SonicWall SMA Exploit Chain](https://www.resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain)
- [sk182336 - Preventative Hotfix for CVE-2024-24919 - Quantum Gateway Information Disclosure](https://support.checkpoint.com/results/sk/sk182336)
- [Analysis of Single Sign-On Abuse on FortiOS](https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios)
- [Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets](https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/)
- [CVE-2024-47575: FortiManager Missing Authentication Zero-Day Vulnerability Explained](https://www.picussecurity.com/resource/blog/cve-2024-47575-fortimanager-missing-authentication-zero-day-vulnerability-explained)
- [Technical Advisory – SonicWall Global Management System (GMS) & Analytics – Multiple Critical Vulnerabilities](https://www.nccgroup.com/research-blog/technical-advisory-sonicwall-global-management-system-gms-analytics-multiple-critical-vulnerabilities/)
- [INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws](https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html)
- [CVE-2023-42793: CozyBear Targets Software Developers Exploiting JetBrains TeamCity](https://www.picussecurity.com/resource/blog/cve-2023-42793-cozybear-targets-software-developers-exploiting-jetbrains-teamcity)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2153