Palo Alto Networks Expedition OS Command Injection Vulnerability (CVE-2024-9463) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTPalo Alto Networks Expedition migration tool versions prior to 1.2.96
Unauthenticated remote attackers can execute arbitrary OS commands as root, leading to the exposure of PAN-OS firewall usernames, cleartext passwords, device configurations, and API keys
Immediately upgrade Expedition to version 1.2.96 or later, and rotate all potentially exposed firewall credentials and API keys
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Access the Expedition server via SSH to update the package repositories and upgrade the software to version 1.2.96 or later.
# Update package lists and upgrade the Expedition package
sudo apt-get update
sudo apt-get --only-upgrade install -y expedition
# Restart the web service and verify the installed version
sudo systemctl restart apache2
dpkg -l | grep expedition2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict network access to the Expedition web console to trusted administrator IP addresses only.
# Restrict HTTP/HTTPS access to a trusted admin IP (e.g., 192.168.1.100) using UFW
sudo ufw default deny incoming
sudo ufw allow from 192.168.1.100 to any port 80 proto tcp
sudo ufw allow from 192.168.1.100 to any port 443 proto tcp
sudo ufw enable3. Log Audit & IoC Verification Commands
Inspect web server access logs for potential command injection patterns and check for unauthorized file modifications.
# Search Apache access logs for suspicious command execution patterns
sudo grep -Ei '(/bin/sh|/bin/bash|curl|wget|eval|system)' /var/log/apache2/access.log
# Check for recently modified files in the web root directory
sudo find /var/www/html/ -mtime -7 -type fStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-9463) is an OS command injection flaw in Palo Alto Networks Expedition, a migration tool designed to assist in firewall configuration transitions. The root cause lies in the application's failure to properly sanitize or escape user-supplied input before passing it to system shell execution functions (CWE-78). This allows unauthenticated remote attackers to inject malicious shell commands via the web interface.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by sending specially crafted HTTP requests containing shell metacharacters (such as ';', '&&', or '|') to vulnerable endpoints within the Expedition web application. Because the underlying processes run with elevated privileges (root), the injected commands are executed directly on the host operating system. This grants the attacker full control over the Expedition environment, enabling them to extract sensitive database contents, including cleartext credentials, configurations, and API keys of integrated PAN-OS firewalls.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog, with an EPSS score of 0.9855 (98.55%), indicating an extremely high threat level. Successful exploitation compromises the integrity of the entire network security infrastructure. By obtaining PAN-OS firewall API keys and administrative credentials, attackers can bypass perimeter defenses, pivot laterally into internal networks, and execute further high-impact attacks.
Official Vendor Advisories & References
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Frequently Asked SecOps Questions (CVE-2024-9463)
FAQQ1. How critical is CVE-2024-9463 and is it actively exploited in the wild?
CVE-2024-9463 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 98.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-9463?
Primary impacted vendors include paloaltonetworks across expedition. Scope summary: All versions of Palo Alto Networks Expedition prior to 1.2.96 (Patched in 1.2.96)
Q3. What temporary mitigations or workarounds exist for CVE-2024-9463 before patching?
[Mitigation] Immediately upgrade Expedition to version 1.2.96 or later, and rotate all potentially exposed firewall credentials and API keys Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-9463
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (paloaltonetworks)
View Category →Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.