CVE-2024-9463Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

9.9 CRITICALEPSS 98.54%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 08:24 UTC

OverviewCVSS details

9.9CRITICALCVSS 4.0

Score source: palo_alto (CNA)
NVD status: Analyzed
Published: Oct 9, 2024
Assigner: palo_alto

Affected

Expedition (Palo Alto Networks)

Versions: 1.2.0 before 1.2.96
Fixed in: 1.2.96

Exploitation

Public exploit: None listed
CISA KEV: Listed · Nov 14, 2024
KEV due date: Dec 5, 2024
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 7

98.54%chance of exploitation in 30 days

Higher than 99.92% of CVEs

CVSS 4.0 · palo_alto (CNA)

9.9Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): High
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.9	CRITICAL	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber
7.5	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA required action

⚡ Known exploited · remediation due Dec 5, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2024-9463
Status: Analyzed
Assigner (CNA): palo_alto
Published: Oct 9, 2024
Last modified: 2026-06-17 08:24 UTC
Weaknesses: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:41 UTC.