CVE-2024-9465: Palo Alto Networks Expedition unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with high confidentiality impact, KEV listing, and near-maximum EPSS.

What it is

Expedition contains a SQL injection flaw reachable without authentication. It lets an attacker read the Expedition database, exposing password hashes, usernames, device configurations and device API keys, and also create and read arbitrary files on the system. Because the data exposed feeds downstream firewall management, the exposure extends beyond the Expedition host itself.

Impact

An attacker gains read access to sensitive Expedition data including credential hashes and device API keys, plus the ability to create and read arbitrary files on the Expedition system. That data can be used to pivot into managed firewall infrastructure.

Attack surface

Reachable over the network with no authentication and no user interaction, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). The description does not specify the exact endpoint or parameter, so the precise injection point is not stated in this record.

Exploitation

Listed in CISA KEV with a due date of 2024-12-05, and EPSS is 0.99626 (99.9th percentile), indicating active exploitation and very high likelihood. A public exploit write-up is referenced by Horizon3.

What to do

• Apply the vendor fix per Palo Alto Networks advisory PAN-SA-2024-0010; if no fix is available for your version, discontinue use of Expedition as CISA directs.
• Restrict network access to Expedition to trusted management hosts only; it should not be internet-facing.
• Rotate credentials and device API keys that were stored in or processed by Expedition, and review device configurations for tampering.
• Monitor and audit files created on the Expedition host for signs of arbitrary file writes.
• If Expedition is not actively needed, decommission it rather than leaving it exposed.

Detection

• Review Expedition and web server logs for anomalous SQL syntax or injection patterns in request parameters.
• Alert on unexpected file creation or modification on the Expedition host, especially outside normal application paths.
• Monitor for outbound connections from Expedition to unfamiliar hosts that could indicate data exfiltration.
• Hunt for use of credentials or API keys originating from Expedition against managed firewall devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.