CVE-2024-9464: Palo Alto Networks Expedition OS command injection as root

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityRoot-level command execution with high confidentiality, integrity and availability impact, combined with a very high EPSS score and public exploitation research, makes this urgent despite the low-privilege requirement.

What it is

Expedition contains an OS command injection flaw (CWE-78) that lets an authenticated attacker execute arbitrary operating system commands with root privileges. Because Expedition stores credentials and configuration data for managed PAN-OS firewalls, successful exploitation exposes sensitive material used to administer those devices.

Impact

An attacker gains root-level command execution on the Expedition host and can read usernames, cleartext passwords, device configurations and device API keys belonging to PAN-OS firewalls. Those secrets can be reused to reach and control the firewalls themselves.

Attack surface

The CVSS 4.0 vector is network-reachable (AV:N) with low attack complexity and no user interaction, but requires low privileges (PR:L), so the attacker must already hold a valid Expedition account. No pre-authentication path is described in the record.

Exploitation

The record shows no CISA KEV listing and no ransomware association, but EPSS is very high at 0.826 (99.6th percentile), and a public Horizon3 attack-research writeup is referenced, indicating mature public exploitation research.

What to do

• Apply the vendor fix per Palo Alto Networks advisory PAN-SA-2024-0010 as the first action.
• Restrict network access to the Expedition interface to trusted administrative hosts only.
• Rotate credentials, device API keys and firewall configurations that were stored in or processed by Expedition.
• Audit and remove unnecessary Expedition user accounts to reduce the authenticated attack surface.
• Monitor Expedition hosts for unexpected outbound connections or command execution.

Detection

• Alert on unexpected child processes spawned by the Expedition web/application service, especially shells or command interpreters.
• Monitor for outbound connections from Expedition hosts to unfamiliar destinations that could indicate exfiltration of stored credentials.
• Review Expedition authentication logs for logins from unusual source addresses or at unusual times.
• Track access to Expedition configuration and credential stores for reads outside normal administrative workflows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.