CVE-2024-9463

9.9 criticalKEVEPSS 99%

Critical (9.9) in Palo Alto Networks Expedition. In CISA KEV since 2024-11-14. EPSS 99% chance of exploitation in the next 30 days.

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

Severity

CVSS 4.0

9.9 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2024-11-14, due 2024-12-05
CWE: CWE-78
Published: 2024-10-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

paloaltonetworks:expedition

References

https://security.paloaltonetworks.com/PAN-SA-2024-0010
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463

Check your stack JSON