Actively exploited in the wild

Palo Alto Networks Expedition Missing Authentication Vulnerability

Palo Alto Networks - Expedition · Listed in the CISA KEV since 2024-11-07. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2024-5910

CriticalCVSS 9.8KEV

Published: 10/07/2024(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access. Configuration secrets, credentials, and other data imported into Expedition are at risk.

Risk Assessment

An attacker can take over the admin account and gain access to sensitive data such as configuration secrets and credentials.

Recommendation

Apply available security updates for Palo Alto Networks Expedition and restrict network access to the tool.

Other vulnerabilities in Palo Alto Networks Expedition

CVE-2024-9465CriticalActively exploited
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal database contents, such as password hashes, usernames, device configurations, and API keys. Attackers can also create and read arbitrary files on the system.

Original NVD description (English source)

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.