Loading story…
Palo Alto Networks disclosed multiple critical vulnerabilities in its Expedition migration tool that can expose sensitive data and let attackers compromise firewall administration. The flaws affect Expedition versions earlier than 1.2.96 and include root command execution, unauthenticated root command execution, SQL database data extraction, authenticated access to confidential information, and an XSS issue that can enable browser session hijacking. Palo Alto said the bugs do not directly affect its firewalls, Panorama, Prisma Access, or Cloud NGFW products.
The company released Expedition version 1.2.96 to fix the issues and urged customers to rotate all usernames, passwords, and PAN-OS firewall API keys processed by Expedition after upgrading. Palo Alto also advised restricting network access to Expedition to authorized users only and reviewing systems for signs of compromise, including suspicious activity and indicators tied to CVE-2024-9465, such as entries in the cronjobs table.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks released Expedition version 1.2.96 to remediate the disclosed vulnerabilities. The company advised customers to rotate usernames, passwords, and API keys handled by Expedition after upgrading, restrict network access to authorized users, and review systems for signs of compromise such as suspicious cronjob entries related to CVE-2024-9465.
Palo Alto Networks published advisory PAN-SA-2024-0010 disclosing multiple critical vulnerabilities in its Expedition migration tool affecting versions earlier than 1.2.96. The flaws could enable root command execution, database data extraction, access to confidential information, XSS-based session hijacking, and takeover of firewall administrator accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed multiple critical and high-severity vulnerabilities in **Expedition**, its migration and management tool for firewalls, affecting versions earlier than `1.2.96`. The flaws include **SQL injection**, **reflected XSS**, unauthorized access to sensitive data, arbitrary file read and write, and **remote command execution**. According to the advisory and follow-on reporting, attackers can use the bugs to obtain firewall credentials, device configurations, and **PAN-OS API keys**, creating a path from Expedition compromise to broader access across connected firewall environments. The most serious risk is **remote code execution** on Expedition and potential full compromise of connected **PAN-OS** firewalls. Public reporting said a proof of concept is available for `CVE-2024-9464` when chained with the older `CVE-2024-5910`, which can reset administrator accounts and further ease takeover. Palo Alto Networks urged organizations to upgrade to **Expedition 1.2.96 or later**, rotate credentials and cryptographic material on both Expedition and managed firewalls, and restrict or disable Expedition where immediate patching is not possible.
Jul 24, 2026
Palo Alto Networks disclosed multiple vulnerabilities in its **Expedition** migration tool that can expose sensitive firewall data and enable further compromise of managed environments. The issues affect Expedition versions earlier than `1.2.101`, with the most severe flaw tracked as **`CVE-2025-0103`**. Reported impacts include unauthorized access to sensitive information, file creation and deletion, file enumeration, session theft, and command injection. The risk is heightened because Expedition databases and files can store **PAN-OS firewall credentials, configuration data, and API keys**, creating a path for follow-on attacks against production firewalls. Palo Alto said Expedition support ended on **December 31, 2024**, and urged organizations to upgrade immediately to version `1.2.101` and move to supported alternative products to reduce exposure.
Jul 24, 2026
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026