{"schema":"threatline.record/2","record":{"id":"CVE-2024-9463","aliases":[],"summary":"Palo Alto Networks Expedition OS Command Injection Vulnerability","details":"Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.","categories":["Unclassified"],"product":"Expedition","vendor":"Palo Alto Networks","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-9463","source_modified_at":"2025-10-21T22:55:42.730Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Expedition","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"1.2.96","status":"unaffected"}],"lessThan":"1.2.96","status":"affected","version":"1.2.0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-9463","source_modified_at":"2025-10-21T22:55:42.730Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Expedition","ecosystem":null},"version":"1.2.96","basis":"first unaffected version stated in the CVE record"}],"cvss":9.9,"severity":"Critical","kev":{"listed":true,"date_added":"2024-11-14","due_date":"2024-12-05","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.98546,"percentile":0.99923,"score_date":"2026-10-23"},"published_at":"2024-10-09T17:03:12.012Z","modified_at":"2025-10-21T22:55:42.730Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-9463","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T22:55:42.730Z"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9463.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9463","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Nuclei","EPSS"],"references":[{"source":"CVE List","url":"https://security.paloaltonetworks.com/PAN-SA-2024-0010","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9463","source":"CISA KEV"},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2025-08-20T03:55:56.863014Z"},"exploits":[{"source":"Nuclei","kind":"Scanner template","name":"PaloAlto Networks Expedition - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9463.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2025-10-21T22:55:42.730Z","content_hash":"67190ec13d907c0a087aa348d8167e64745ea92788516f4c00292192c90f3225"}}