Cyber Resilience

CVE-2024-9463

CriticalCISA KEVActive ExploitationEUVD ExploitedRCE

Published: 09 October 2024

Published
09 October 2024
Modified
04 November 2025
KEV Added
14 November 2024
Patch
CVSS Score v4 9.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber
EPSS Score 0.9420 99.9th percentile
Risk Priority 96 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-9463 is a critical-severity OS Command Injection (CWE-78) vulnerability in Paloaltonetworks Expedition. Its CVSS base score is 9.9 (Critical).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-9463 is an OS command injection vulnerability, tracked under CWE-78, that affects Palo Alto Networks Expedition. The flaw permits unauthenticated remote attackers to execute arbitrary operating system commands with root privileges on the Expedition instance, directly exposing usernames, cleartext passwords, device configurations, and API keys belonging to managed PAN-OS firewalls.

An attacker can exploit the issue over the network without authentication or user interaction, achieving full control of the Expedition host and harvesting the enumerated credentials and configuration data that can then be used to compromise associated PAN-OS devices.

Palo Alto Networks published advisory PAN-SA-2024-0010 detailing remediation steps, and the vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog, confirming that mitigations and patches should be applied promptly.

The EPSS score has remained at a high level, with a recorded peak of 0.9623 and a current value of 0.9420, underscoring sustained exploitation interest after disclosure.

EU & UK References

Vulnerability details

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

CWE(s)
KEV Date Added
14 November 2024

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

paloaltonetworks
expedition
1.2.0 — 1.2.96

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of inputs to block OS command injection payloads before they reach the Expedition shell.

prevent

Enforces least privilege so that even a successful injection cannot yield unrestricted root execution on the Expedition host.

prevent

Mandates timely application of vendor patches that close the unauthenticated command-injection flaw described in PAN-SA-2024-0010.

References