Expedition vulnerabilities

6 known vulnerabilities in Expedition from Palo Alto Networks. 6 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Cloud NGFW: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-0107Jan 11, 2025Palo Alto NetworksEPSS 78.4%

  An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations

• 9.1 Critical severity

  Cloud NGFW: External Control of File Name or Path

  CVE-2025-0105Jan 11, 2025Palo Alto NetworksEPSS 13.2%

  An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.

• 8.8 High severity

  Cloud NGFW: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-0103Jan 11, 2025Palo Alto Networks

  An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers

• 9.1 Critical severity

  Palo Alto Networks Expedition SQL Injection Exploited

  CVE-2024-9465Oct 9, 2024Palo Alto NetworksEPSS 99.6%

  An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and

• 7.5 High severity

  Palo Alto Networks Expedition OS Command Injection Exploited

  CVE-2024-9463Oct 9, 2024Palo Alto NetworksEPSS 98.5%

  An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys

• 9.8 Critical severity

  Palo Alto Networks Expedition Missing Authentication Exploited

  CVE-2024-5910Jul 10, 2024Palo Alto NetworksEPSS 91.7%

  Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichme