CVE-2024-9463: Palo Alto Networks Expedition OS Command Injection Vulnerability

CVE-2024-9463 · Severity: critical · CVSS 9.9 · Exploited in the wild · Published 2024-11-14

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated remote attacker to execute arbitrary commands as root. Successful exploitation leads to the full compromise of the Expedition tool and the disclosure of sensitive PAN-OS firewall data, including credentials, configurations, and API keys.

Technologies: Palo Alto Networks Expedition. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2024-9463 exploited in the wild?
Yes. CVE-2024-9463 is known to be exploited in the wild, first recorded on 14 November 2024. Treat it as urgent.
How severe is CVE-2024-9463?
Critical severity, with a CVSS score of 9.9, published 14 November 2024.
Which products and versions are affected?
Palo Alto Networks Expedition 1.2.0 to 1.2.96 (excluding 1.2.96).
Is there a fix for CVE-2024-9463?
A patch was published on 2024-10-09: Fixed in Expedition 1.2.96 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-9463 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-9463?
Check whether you run Palo Alto Networks Expedition. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Palo Alto Networks Expedition 1.2.0 to 1.2.96 (excluding 1.2.96)

Timeline

  • 2024-10-09: disclosed: Initial disclosure by Palo Alto Networks
  • 2024-10-09: patched: Fixed in Expedition 1.2.96
  • 2024-11-14: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2024-11-14: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.