CVE-2024-9465: Palo Alto Expedition unauthenticated SQL injection, actively exploited
The short version: CVE-2024-9465 is an unauthenticated SQL injection in Palo Alto Networks Expedition, the firewall migration tool. An attacker can read the Expedition database — password hashes, usernames, device configurations, and device API keys — and create or read arbitrary files on the system. Those API keys can unlock the firewalls Expedition manages. It's confirmed exploited and in CISA's KEV catalog. Expedition shouldn't be internet-facing — but if it is, move. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — credential theft that can unlock your firewalls (see below) |
| CVSS v3.1 (NVD) | 9.1 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | ~99.61% · 99.95th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2024-12-05 |
| Known exploited? | Yes — CISA confirmed active exploitation |
| Vulnerability type | CWE-89 SQL injection → disclosure of credentials/API keys + arbitrary file read/write |
| Requires authenticated session? | No — pre-authentication |
| Affected | Palo Alto Networks Expedition versions before 1.2.96 |
| Fixed in | Expedition 1.2.96 and later |
What you need to know
Expedition is Palo Alto's tool for migrating and consolidating firewall configurations. CVE-2024-9465 is an unauthenticated SQL injection: an attacker who can reach Expedition can query its database directly, exposing password hashes, usernames, device configurations, and device API keys, and can also read and write files on the host.
Why it matters more than "just" an SQL injection:
- The data is the crown jewels. Expedition holds credentials and API keys for the firewalls it manages — leaking them can hand an attacker control of your Palo Alto devices.
- It's pre-authentication and trivially automatable, with a very high EPSS.
- It's confirmed exploited. CISA flagged active exploitation of Expedition and added it to KEV; Palo Alto advised disabling the tool if you can't update.
How serious we see it
High — and worse where Expedition is exposed.
NVD scores it 9.1 (Critical). We rate the real-world exposure High with clear upside risk: Expedition is a management/migration utility that should sit on a restricted internal network, not the public internet — so for most organizations the population of internet-facing instances is small. But where one is reachable, unauthenticated theft of firewall credentials and API keys is a fast path to broader compromise, so treat any exposed instance as urgent. The bounded, reassuring part: a single fixed version (1.2.96) resolves it, and simply turning the tool off removes the exposure.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Update now. Upgrade Expedition to 1.2.96 or later.
- If you can't update immediately, turn Expedition off. Palo Alto's own guidance — it removes the exposure outright.
- Get Expedition off the internet. Restrict access to trusted internal IPs; it should never be publicly reachable.
- Rotate what it held. Assume disclosed firewall credentials and API keys are compromised — rotate them and review for unauthorized use. Palo Alto published an IoC query to check for signs of exploitation.
- Confirm your exposure first. Verify whether any Expedition instance is reachable and on an affected version.
How BreachRisk sees it
BreachRisk discovers internet-facing Palo Alto Expedition instances from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one so it rises to the top of your results.
That continuous, outside-in view is the point: a management tool that quietly ended up reachable — the kind of thing that's easy to forget — surfaces as a ranked, KEV-flagged finding before someone uses it to lift your firewall keys.