Palo Alto Networks issued security advisory PAN-SA-2024-0010 warning of multiple vulnerabilities across its Expedition configuration migration tool prior to version 1.2.96. The most severe flaw, CVE-2024-9463 (CVSS 9.9), is an unauthenticated OS command injection vulnerability in the web interface that allows remote adversaries to execute arbitrary commands with root privileges. In tandem, CVE-2024-9465 (CVSS 9.2) introduces unauthenticated SQL injection, while CVE-2024-9464 enables authenticated command execution. These flaws expose the backend database and local filesystem, where Expedition stores extracted configuration archives, device usernames, and cleartext credentials.

Following public dissemination of proof-of-concept exploit chains—including weaponization alongside the admin reset flaw CVE-2024-5910—CISA added Expedition vulnerabilities to its Known Exploited Vulnerabilities catalog. Threat actors target exposed Expedition servers to harvest PAN-OS device API keys and firewall administrative secrets, enabling complete takeover of interconnected enterprise perimeter firewalls. Palo Alto Networks urged administrators to immediately update to Expedition 1.2.96, rotate all firewall credentials and API keys previously ingested by the platform, or restrict network access to trusted administrative hosts.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Migration utilities represent high-trust architectural pivots; executing unauthenticated root command injection on Expedition exposes plaintext credentials and device API keys that directly bypass perimeter firewall segmentation.
• Bullet 2 — Strategic & Defender Imperative: Security teams must immediately deploy Expedition 1.2.96, decommission exposed migration instances, and enforce comprehensive credential and API key revocation across all managed PAN-OS firewalls.