CVE-2025-0107: Palo Alto Networks Expedition unauthenticated OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote command execution exposing firewall credentials and API keys, with very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

Expedition contains an OS command injection flaw (CWE-78) that lets an unauthenticated remote attacker execute arbitrary OS commands as the www-data user. Because Expedition stores firewall credentials and configuration data, successful exploitation exposes usernames, cleartext passwords, device configurations and PAN-OS device API keys.

Impact

An attacker gains command execution on the Expedition host and can read stored credentials, firewall configurations and API keys, enabling lateral movement into managed PAN-OS firewalls. The CVSS 4.0 vector shows low direct confidentiality, integrity and availability impact but high subsequent system confidentiality impact.

Attack surface

Reachable over the network with no authentication and no user interaction required (AV:N/PR:N/UI:N). Any network-exposed Expedition instance is a candidate target.

Exploitation

Not listed in CISA KEV and no public exploit reference is provided, but EPSS is very high at 0.785 (99.6th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor fix per Palo Alto Networks advisory PAN-SA-2025-0001; patch Expedition first.
• Restrict network access to Expedition management interfaces to trusted hosts only; do not expose it to the internet.
• Rotate credentials, device API keys and any secrets stored in or managed through Expedition after patching.
• Monitor and review Expedition logs for unexpected command execution or access to credential stores.
• If Expedition is not actively needed, take it offline until patched.

Detection

• Hunt for unexpected child processes spawned by the Expedition web service (www-data) on the Expedition host.
• Alert on outbound connections from Expedition hosts to unfamiliar destinations.
• Review Expedition access logs for unauthenticated requests to endpoints that invoke system commands.
• Monitor for reads of Expedition credential and configuration stores by the web service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.