Loading story…
Palo Alto Networks disclosed multiple vulnerabilities in its Expedition migration tool that can expose sensitive firewall data and enable further compromise of managed environments. The issues affect Expedition versions earlier than 1.2.101, with the most severe flaw tracked as CVE-2025-0103. Reported impacts include unauthorized access to sensitive information, file creation and deletion, file enumeration, session theft, and command injection.
The risk is heightened because Expedition databases and files can store PAN-OS firewall credentials, configuration data, and API keys, creating a path for follow-on attacks against production firewalls. Palo Alto said Expedition support ended on December 31, 2024, and urged organizations to upgrade immediately to version 1.2.101 and move to supported alternative products to reduce exposure.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks released security updates for five vulnerabilities affecting Expedition versions earlier than 1.2.101, including CVE-2025-0103. The flaws could allow unauthorized access to sensitive data, file operations, session theft, and command injection, with risk heightened by stored firewall credentials and API keys.
Palo Alto Networks stated that support for the Expedition migration tool ended on December 31, 2024, and advised customers to migrate to supported alternatives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcesecurity.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed multiple critical and high-severity vulnerabilities in **Expedition**, its migration and management tool for firewalls, affecting versions earlier than `1.2.96`. The flaws include **SQL injection**, **reflected XSS**, unauthorized access to sensitive data, arbitrary file read and write, and **remote command execution**. According to the advisory and follow-on reporting, attackers can use the bugs to obtain firewall credentials, device configurations, and **PAN-OS API keys**, creating a path from Expedition compromise to broader access across connected firewall environments. The most serious risk is **remote code execution** on Expedition and potential full compromise of connected **PAN-OS** firewalls. Public reporting said a proof of concept is available for `CVE-2024-9464` when chained with the older `CVE-2024-5910`, which can reset administrator accounts and further ease takeover. Palo Alto Networks urged organizations to upgrade to **Expedition 1.2.96 or later**, rotate credentials and cryptographic material on both Expedition and managed firewalls, and restrict or disable Expedition where immediate patching is not possible.
Jul 24, 2026
Palo Alto Networks disclosed multiple critical vulnerabilities in its **Expedition** migration tool that can expose sensitive data and let attackers compromise firewall administration. The flaws affect Expedition versions earlier than `1.2.96` and include root command execution, unauthenticated root command execution, SQL database data extraction, authenticated access to confidential information, and an **XSS** issue that can enable browser session hijacking. Palo Alto said the bugs do **not** directly affect its firewalls, **Panorama**, **Prisma Access**, or **Cloud NGFW** products. The company released Expedition version `1.2.96` to fix the issues and urged customers to rotate all usernames, passwords, and **PAN-OS firewall API keys** processed by Expedition after upgrading. Palo Alto also advised restricting network access to Expedition to authorized users only and reviewing systems for signs of compromise, including suspicious activity and indicators tied to `CVE-2024-9465`, such as entries in the `cronjobs` table.
Jun 29, 2026
Palo Alto Networks disclosed and patched **13 vulnerabilities** across its products, led by **`CVE-2026-0288`**, a high-severity flaw in **PAN-OS** that can let an unauthenticated attacker with network access trigger memory corruption through specially crafted traffic. The bug stems from multiple buffer overflows in the **User-ID Terminal Server Agent (TSA)** component and can lead to **denial of service** and potentially **arbitrary code execution** on affected firewalls. Palo Alto said the issue affects PAN-OS devices only when at least one TSA entry is configured, while **Panorama** and **Cloud NGFW on AWS** are not affected. The company assigned the flaw a **CVSS-B score of 9.2** for exposed deployments and said it has **no evidence of active exploitation**, but urged customers to patch immediately or restrict TSA access to trusted internal IP addresses as a mitigation. The broader advisory batch also addressed medium- and low-severity issues in **PAN-OS** and **Prisma Access Agent**, including vulnerabilities that could enable **root command execution, unauthorized internal requests, authentication bypass, VPN interception via MitM, DLP policy bypass, privilege escalation, XSS-driven code execution, file deletion, and information disclosure**.
Jul 10, 2026