Palo Alto Networks Expedition Administrator Account Takeover and Authentication Bypass Vulnerability (CVE-2024-5910) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTPalo Alto Networks Expedition versions prior to 1.2.92
Attackers with network access can bypass authentication to take over the Expedition administrator account, exposing firewall configurations, credentials, and API keys
Immediately upgrade Expedition to version 1.2.92 or later, and restrict network access to authorized administrator IPs only
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Access your Expedition server via SSH and run the following commands to update the package repository and upgrade to the patched version (1.2.92 or later).
# Update package lists and upgrade Expedition
sudo apt-get update
sudo apt-get --only-upgrade install expedition-beta -y
# Verify the installed version is 1.2.92 or higher
dpkg -l | grep expedition2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the Expedition web interface (TCP 80, 443) using firewall rules so that only trusted administrator IP addresses can access the service.
# Set default firewall policies to block incoming traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow access to HTTP/HTTPS only from a trusted admin IP (e.g., 192.168.10.50)
sudo ufw allow from 192.168.10.50 to any port 443 proto tcp comment 'Allow Admin HTTPS'
sudo ufw allow from 192.168.10.50 to any port 80 proto tcp comment 'Allow Admin HTTP'
# Enable the firewall and verify rules
sudo ufw enable
sudo ufw status verbose3. Log Audit & IoC Verification Commands
Inspect the web server access logs for unauthorized POST requests to administrative or configuration endpoints to identify potential exploitation attempts.
# Search web server logs for suspicious POST requests to API or operations endpoints
# (Example pattern for identifying potential unauthorized administrative actions)
grep -E 'POST /(bin/|api/|operations/)' /var/log/apache2/access.log | grep -E '200 |302 'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-5910) is a critical missing authentication vulnerability (CWE-306) in Palo Alto Networks Expedition, a configuration migration and optimization tool. Due to a lack of proper authentication checks on critical API endpoints, unauthenticated remote attackers with network access can directly invoke administrative functions without providing valid credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker with network access to the Expedition server can send specially crafted HTTP requests to the vulnerable, unauthenticated endpoints. This allows the attacker to reset the administrator password or create a new administrative account, effectively taking full control of the Expedition console. Once administrative access is obtained, the attacker can extract sensitive configuration secrets, device credentials, and API keys imported into the tool.
3. Infrastructure & Business Impact
Because Expedition is designed to process highly sensitive firewall configurations and network topologies, a compromise of this system has severe downstream consequences. Attackers can leverage the stolen credentials and network diagrams to pivot into the broader corporate network, leading to potential full-scale infrastructure compromise, unauthorized policy modifications, and significant business disruption. This vulnerability is actively exploited in the wild (CISA KEV listed) with an EPSS score of 0.9168, representing an immediate threat.
Official Vendor Advisories & References
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
Frequently Asked SecOps Questions (CVE-2024-5910)
FAQQ1. How critical is CVE-2024-5910 and is it actively exploited in the wild?
CVE-2024-5910 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 91.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-5910?
Primary impacted vendors include paloaltonetworks across expedition. Scope summary: All versions of Palo Alto Networks Expedition prior to 1.2.92 (Fixed in 1.2.92)
Q3. What temporary mitigations or workarounds exist for CVE-2024-5910 before patching?
[Mitigation] Immediately upgrade Expedition to version 1.2.92 or later, and restrict network access to authorized administrator IPs only Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-5910
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (paloaltonetworks)
View Category →Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).
TrueConf Server Unauthenticated Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2026-72529)
[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier
MikroTik RouterOS Authentication Bypass, Kernel Panic, and Info Leak (CVE-2026-67277) Security Advisory
[Affected Scope] MikroTik RouterOS versions 6.x and 7.x prior to specific patched releases.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.