---
id: "CVE-2024-9463"
kind: "vulnerability"
aliases: ["CVE-2024-9463"]
title: "paloaltonetworks expedition: An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run\u2026"
severity: "critical"
cvss: 9.9
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Palo Alto Networks Expedition", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "paloaltonetworks expedition", "fixed": ["1.2.96"], "affected": ">= 1.2.0, < 1.2.96", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["expedition", "exploited", "infrastructure", "palo-alto-networks", "pan-os"]
not_affected_if: ["not-deployed"]
published_at: "2024-10-09T17:15:19+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9463", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9463", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# paloaltonetworks expedition: An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run…

Palo Alto Networks Expedition, a migration tool for Palo Alto firewall configurations, has an OS command injection flaw. An unauthenticated attacker can run arbitrary OS commands as root and read usernames, cleartext passwords, device configurations and PAN-OS firewall API keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Palo Alto Networks Expedition affected ? fixed ?
- vendor:paloaltonetworks expedition affected >= 1.2.0, < 1.2.96 fixed 1.2.96

## How to check

Check whether Expedition is deployed in your environment, and confirm its version against the vendor advisory. unknown

## Fix

Apply the vendor mitigations per Palo Alto Networks guidance, or discontinue use of Expedition if mitigations are unavailable. Rotate firewall API keys and passwords that Expedition stored.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9463
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-9463

## From the sources

Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_