CVE-2024-9465Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.

9.2 CRITICALEPSS 99.62%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 08:24 UTC

OverviewCVSS details

9.2CRITICALCVSS 4.0

Score source: palo_alto (CNA)
NVD status: Analyzed
Published: Oct 9, 2024
Assigner: palo_alto

Affected

Expedition (Palo Alto Networks)

Versions: 1.2.0 before 1.2.96
Fixed in: 1.2.96

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Listed · Nov 14, 2024
KEV due date: Dec 5, 2024
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 7

99.62%chance of exploitation in 30 days

Higher than 99.94% of CVEs

CVSS 4.0 · palo_alto (CNA)

9.2Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: Low
Availability impact: None
Confidentiality (other systems): High
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

9.1Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.2	CRITICAL	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber
9.1	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA required action

⚡ Known exploited · remediation due Dec 5, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2024-9465
Status: Analyzed
Assigner (CNA): palo_alto
Published: Oct 9, 2024
Last modified: 2026-06-17 08:24 UTC
Weaknesses: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:41 UTC.