A critical Palo Alto Networks bug is being hit by cyberattacks, so patch now

A person at a laptop with a cybersecure lock symbol floating above it.
(Image credit: Shutterstock / laymanzoom)

  • A bug Palo Alto addressed last summer is being abused in the wild
  • CISA added it to its KEV catalog, giving federal agencies a deadline to patch
  • The bug can be abused to take over accounts and steal data

A critical bug found in Palo Alto Networks’ Expedition program is being abused in the wild, the US government has warned.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-5910 to its Known Exploited Vulnerabilities (KEV) catalog, which means there is evidence of abuse in the wild.

This vulnerability, discovered in Expedition in the summer of 2023, is described as a “missing authentication for a critical function” bug, which can lead to Expedition admin account takeover for crooks with network access. Since Expedition is a tool that helps with configuration migration, tuning, and enrichment, it may contain secrets, credentials, and other data, which would then be at risk of theft.

Proof of concept

Users are advised to apply a patch immediately, since the vulnerability allows threat actors to take over admin accounts, steal sensitive data, and more.

When CISA adds a vulnerability to KEV, it gives federal agencies a deadline to patch it, or stop using the afflicted applications completely. The due date for Palo Alto Networks Expedition is November 28, 2024.

CISA did not share any further details about the attacks, but BleepingComputer dug up a report from Horizon3.ai, who released a proof-of-concept exploit in October 2024. By chaining the bug with CVE-2024-9464, crooks could gain unauthenticated arbitrary command execution capabilities on vulnerable Expedition servers.

This additional vulnerability was also discovered, and patched, last month. Palo Alto Networks said it could have been used to take over admin accounts in firewalls, and take over PAN-OS instances.

For those unable to install the patch immediately, a workaround is available, which includes restricting Expedition network access to authorized users, hosts, and networks, only.

"All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating," Palo Alto Networks concluded.

Via BleepingComputer

You might also like

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
The best free firewall
Palo Alto Networks PAN-OS sees authentication bypass under attack from hackers
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
The best free firewall
Palo Alto warns another major firewall hack has been detected
A digital themed isometric showing a neon padlock in the foreground, and a technological diagram of a processor logic board in the background.
CISA tells agencies to patch BeyondTrust bug now
Representational image depecting cybersecurity protection
CISA says Oracle and Mitel have critical security flaws being exploited
Best free Linux firewalls
Fortinet warns a critical vulnerability in its systems could let attackers breach company networks
Latest in Security
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
UK Prime Minister Sir Kier Starmer
The UK releases timeline for migration to post-quantum cryptography
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
Latest in News
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 23 (game #1154)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Sunday, March 23 (game #385)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Sunday, March 23 (game #651)
Google Pixel 9 Pro Fold main display opened
Apple is rumored to be prioritizing battery life on the foldable iPhone – which could also feature a liquid metal hinge for added durability
Google Pixel 9
The Google Pixel 10 just showed up in Android code – and may come with a useful speed boost
L-mount alliance
Sirui joins L-Mount Alliance to deliver its superb budget lenses for Leica, DJI, Sigma and Panasonic cameras