CVE-2024-9463

UNKNOWN 0.0

⚠️ CISA KEV

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

CWE	CWE-78
Vendor	palo alto networks
Product	expedition
Published	Oct 9, 2024
Last Updated	Oct 21, 2025

⚠️ Actively Exploited — Act Now

Get instant alerts for palo alto networks expedition

This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2024-9463.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Palo Alto Networks / Expedition

1.2.0 < 1.2.96

References

NVD ↗ CVE.org ↗ EPSS Data ↗

security.paloaltonetworks.com: https://security.paloaltonetworks.com/PAN-SA-2024-0010 cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463

Credits

Enrique Castillo of Palo Alto Networks