Loading story…
Palo Alto Networks disclosed multiple critical and high-severity vulnerabilities in Expedition, its migration and management tool for firewalls, affecting versions earlier than 1.2.96. The flaws include SQL injection, reflected XSS, unauthorized access to sensitive data, arbitrary file read and write, and remote command execution. According to the advisory and follow-on reporting, attackers can use the bugs to obtain firewall credentials, device configurations, and PAN-OS API keys, creating a path from Expedition compromise to broader access across connected firewall environments.
The most serious risk is remote code execution on Expedition and potential full compromise of connected PAN-OS firewalls. Public reporting said a proof of concept is available for CVE-2024-9464 when chained with the older CVE-2024-5910, which can reset administrator accounts and further ease takeover. Palo Alto Networks urged organizations to upgrade to Expedition 1.2.96 or later, rotate credentials and cryptographic material on both Expedition and managed firewalls, and restrict or disable Expedition where immediate patching is not possible.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that a public proof-of-concept exists for CVE-2024-9464 when chained with the older CVE-2024-5910, a combination that can reset administrator accounts. The reported impact includes possible remote code execution on Expedition and potential full compromise of connected PAN-OS firewalls.
Palo Alto Networks released security updates for multiple critical and high-severity Expedition flaws, including issues enabling SQL injection, XSS, unauthorized data access, arbitrary file read/write, and command execution. The vendor recommended upgrading to version 1.2.96 or later and rotating credentials and cryptographic material.
Palo Alto Networks published advisory PAN-SA-2024-0010 covering multiple vulnerabilities in Expedition that can expose firewall credentials and affect versions earlier than 1.2.96.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcesecurity.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed multiple vulnerabilities in its **Expedition** migration tool that can expose sensitive firewall data and enable further compromise of managed environments. The issues affect Expedition versions earlier than `1.2.101`, with the most severe flaw tracked as **`CVE-2025-0103`**. Reported impacts include unauthorized access to sensitive information, file creation and deletion, file enumeration, session theft, and command injection. The risk is heightened because Expedition databases and files can store **PAN-OS firewall credentials, configuration data, and API keys**, creating a path for follow-on attacks against production firewalls. Palo Alto said Expedition support ended on **December 31, 2024**, and urged organizations to upgrade immediately to version `1.2.101` and move to supported alternative products to reduce exposure.
Jul 24, 2026
Palo Alto Networks disclosed multiple critical vulnerabilities in its **Expedition** migration tool that can expose sensitive data and let attackers compromise firewall administration. The flaws affect Expedition versions earlier than `1.2.96` and include root command execution, unauthenticated root command execution, SQL database data extraction, authenticated access to confidential information, and an **XSS** issue that can enable browser session hijacking. Palo Alto said the bugs do **not** directly affect its firewalls, **Panorama**, **Prisma Access**, or **Cloud NGFW** products. The company released Expedition version `1.2.96` to fix the issues and urged customers to rotate all usernames, passwords, and **PAN-OS firewall API keys** processed by Expedition after upgrading. Palo Alto also advised restricting network access to Expedition to authorized users only and reviewing systems for signs of compromise, including suspicious activity and indicators tied to `CVE-2024-9465`, such as entries in the `cronjobs` table.
Jun 29, 2026
Palo Alto Networks disclosed and patched **CVE-2026-0300**, a critical `PAN-OS` vulnerability in the **User-ID Authentication Portal** that can let an unauthenticated remote attacker execute arbitrary code with **root** privileges. The flaw, rated **CVSS 9.3**, is described as a stack overflow and out-of-bounds write issue affecting multiple `PAN-OS` release lines, including versions in the `10.2`, `11.1`, `11.2`, and `12.1` branches, on affected **PA Series** and **VM-Series** firewalls. Palo Alto Networks reported signs of **active exploitation**, particularly on devices exposed to the internet or reachable from untrusted IP addresses, and **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog. Exploitation depends on the Authentication Portal being enabled and a management interface profile with a response page being attached to a Layer 3 interface reachable by untrusted traffic; defenders were urged to upgrade to fixed releases, restrict portal access to trusted zones or IP addresses, disable the feature if unnecessary, and investigate systems for signs of compromise.
Jul 24, 2026