CVE-2024-5910: Palo Alto Networks Expedition Missing Authentication Vulnerability

CVE-2024-5910 is a missing authentication vulnerability in Palo Alto Networks Expedition. An attacker who can reach the product over the network can take over an Expedition admin account and potentially retrieve configuration secrets, credentials, and other sensitive data. Because Expedition is commonly used to handle firewall migrations and related configuration material, successful abuse can give an attacker a foothold into broader network and security infrastructure. Confirm all product details and fixed versions against the vendor advisory.

CISA has highlighted the issue and directed organizations to apply vendor mitigations or discontinue use if mitigations are unavailable. Known ransomware use is not documented for this CVE.

How it works

The weakness is classified as CWE-306: Missing Authentication for Critical Function. In this class of flaw, a sensitive operation or administrative interface does not properly require authentication before allowing access or control. According to the available summary, an attacker with network access to Expedition can take over an admin account without the expected authentication step. Once that account is controlled, the attacker may read configuration secrets, credentials, and other data stored or processed by the tool.

Exact request paths, parameters, or exploit sequences are not provided here and must not be assumed. Treat any unauthenticated administrative access as the core risk and verify the precise attack surface against the vendor advisory and your own deployment.

Am I affected? How to find it in your systems

Expedition is a Palo Alto Networks tool typically used for firewall configuration migration and related administrative workflows. It often runs on dedicated servers or workstations inside management or lab networks rather than on production firewalls themselves. Inventory any hosts running Expedition software, including temporary migration systems that may still be online.

• Search asset inventories, CMDB records, and package lists for “Expedition” or related Palo Alto Networks migration tooling.
• Review network diagrams and firewall rules for systems that expose Expedition management interfaces, especially any that are reachable from broader internal segments or the internet.
• Confirm installed versions and configurations against the vendor advisory; only the advisory can state which builds are vulnerable.
• Examine authentication and administrative logs for unexpected admin account creation, password changes, or successful logins that lack corresponding legitimate activity. Look for anomalous access to configuration export or credential-related functions if those are logged.

If Expedition is not present in your environment, this specific CVE does not apply. If it is present, treat any network-reachable instance as potentially exposed until verified and remediated.

How to remediate

Prioritize the vendor’s guidance. Apply the updates or mitigations named in the Palo Alto Networks advisory for CVE-2024-5910. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• Download and install only the official fixed package or configuration change described by the vendor.
• After patching, re-verify that administrative functions now require proper authentication and that no residual unauthenticated access remains.
• Rotate any credentials, API keys, or secrets that may have been stored or processed by Expedition, especially if the system was reachable by untrusted networks.
• Remove or decommission temporary Expedition instances once migration work is complete so they do not remain as long-lived attack surface.

Document the change window and retain evidence of the applied fix for audit and compliance purposes.

If you can't patch immediately

Until the vendor fix can be applied, reduce exposure with compensating controls appropriate to a missing-authentication administrative interface.

• Segment Expedition hosts so they are reachable only from a tightly controlled management network or jump hosts; block all other inbound access at the firewall.
• If the product can be taken offline without business impact, power it down or isolate it completely until patched.
• Disable any unnecessary network listeners or features that expose administrative functionality, following vendor documentation.
• Place a web application firewall or reverse proxy in front of the interface only if it can enforce authentication or block unauthenticated administrative requests; test carefully so legitimate migration work is not broken.
• Increase monitoring: alert on any connection attempts to the Expedition host, unexpected process activity, or administrative log events. Retain packet captures or flow data for later investigation if needed.

These steps lower risk but do not replace the official patch or the option to discontinue use.

If your data may have been exposed

Actively exploited missing-authentication flaws can lead to credential theft and broader compromise. If Expedition was network-reachable and unpatched, assume admin credentials and any stored configuration secrets may have been accessed. Rotate those credentials, review firewall and device configurations for unauthorized changes, and hunt for lateral movement. Organizations can also run a free exposure scan of their email addresses against known breach data sets to check whether related accounts appear in public breach collections.