{"id":"CVE-2024-9463","kind":"vulnerability","aliases":["CVE-2024-9463"],"related":[],"title":"paloaltonetworks expedition: An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run…","description":"Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Palo Alto Networks Expedition, a migration tool for Palo Alto firewall configurations, has an OS command injection flaw. An unauthenticated attacker can run arbitrary OS commands as root and read usernames, cleartext passwords, device configurations and PAN-OS firewall API keys.","severity":"critical","cvss":9.9,"epss":null,"exploited":true,"exploited_at":"2024-11-14T00:00:00+00:00","products":[{"name":"Palo Alto Networks Expedition","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"paloaltonetworks expedition","fixed":["1.2.96"],"affected":">= 1.2.0, < 1.2.96","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["expedition","exploited","infrastructure","palo-alto-networks","pan-os"],"not_affected_if":["not-deployed"],"how_to_check":"Check whether Expedition is deployed in your environment, and confirm its version against the vendor advisory. unknown","fix":"Apply the vendor mitigations per Palo Alto Networks guidance, or discontinue use of Expedition if mitigations are unavailable. Rotate firewall API keys and passwords that Expedition stored.","status":"open","published_at":"2024-10-09T17:15:19+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:14+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:56:14Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per Palo Alto Networks guidance, or discontinue use of Expedition if mitigations are unavailable. Rotate firewall API keys and passwords that Expedition stored.","reach":"network","impact":"high","summary":"Palo Alto Networks Expedition, a migration tool for Palo Alto firewall configurations, has an OS command injection flaw. An unauthenticated attacker can run arbitrary OS commands as root and read usernames, cleartext passwords, device configurations and PAN-OS firewall API keys.","category":"infrastructure","who_cares":["expedition","palo-alto-networks","pan-os"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs commands as root and steals firewall credentials.","analyst_note":"Sources do not list affected or fixed versions or the vendor advisory URL; find the Palo Alto Networks advisory for CVE-2024-9463 to fill in version and mitigation details.","how_to_check":"Check whether Expedition is deployed in your environment, and confirm its version against the vendor advisory. unknown","needs_analyst":true,"not_affected_if":["not-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":2874,"output_tokens":454,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-9463':21A,24A 'action':127C 'allow':13A,94C 'alto':10A,26A,36B,42B,50B,84C 'api':81B,118C 'appli':128C 'arbitrari':64B,100C 'attack':16A,61B,97C 'cisa':125C 'cleartext':72B,112C 'command':5A,56B,66B,90C,102C 'configur':52B,75B,115C 'contain':87C 'cve':19A,22A 'devic':74B,114C,117C 'disclosur':109C 'discontinu':134C 'expedit':2A,12A,31B,44B,86C,106C 'expedition':28A,30A 'exploit':32B 'firewal':51B,80B,124C 'flaw':58B 'infrastructur':33B 'inject':6A,57B,91C 'instruct':132C 'key':82B,119C 'migrat':46B 'mitig':129C,140C 'network':11A,37B,43B,85C 'networks':27A 'os':4A,40B,55B,65B,79B,89C,101C,123C 'palo':9A,25A,35B,41B,49B,83C 'palo-alto-network':34B 'paloaltonetwork':1A 'paloaltonetworks':29A 'pan':39B,78B,122C 'pan-o':38B,77B,121C 'password':73B,113C 'per':130C 'product':138C 'read':70B 'requir':126C 'result':107C 'root':68B,104C 'run':18A,63B,99C 'tool':47B 'unauthent':15A,60B,96C 'unavail':142C 'use':135C 'usernam':71B,111C 'vendor':131C 'vulner':7A,92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-09T17:15:19+00:00","kev":{"dateAdded":"2024-11-14","dueDate":"2024-12-05","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-9463","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9463","severity":null,"published_at":"2024-11-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-9463","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9463","severity":null,"published_at":"2024-10-09T17:15:19+00:00","modified_at":"2026-06-17T08:24:37+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}