A critical Palo Alto Networks bug is being hit by cyberattacks, so patch now

CISA flags a new flaw to KEV

· TechRadar

News By Sead Fadilpašić published 8 November 2024

(Image credit: Shutterstock / laymanzoom)
  • A bug Palo Alto addressed last summer is being abused in the wild
  • CISA added it to its KEV catalog, giving federal agencies a deadline to patch
  • The bug can be abused to take over accounts and steal data

A critical bug found in Palo Alto Networks’ Expedition program is being abused in the wild, the US government has warned.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-5910 to its Known Exploited Vulnerabilities (KEV) catalog, which means there is evidence of abuse in the wild.

This vulnerability, discovered in Expedition in the summer of 2023, is described as a “missing authentication for a critical function” bug, which can lead to Expedition admin account takeover for crooks with network access. Since Expedition is a tool that helps with configuration migration, tuning, and enrichment, it may contain secrets, credentials, and other data, which would then be at risk of theft.

Proof of concept

Users are advised to apply a patch immediately, since the vulnerability allows threat actors to take over admin accounts, steal sensitive data, and more.

When CISA adds a vulnerability to KEV, it gives federal agencies a deadline to patch it, or stop using the afflicted applications completely. The due date for Palo Alto Networks Expedition is November 28, 2024.

CISA did not share any further details about the attacks, but BleepingComputer dug up a report from Horizon3.ai, who released a proof-of-concept exploit in October 2024. By chaining the bug with CVE-2024-9464, crooks could gain unauthenticated arbitrary command execution capabilities on vulnerable Expedition servers.

This additional vulnerability was also discovered, and patched, last month. Palo Alto Networks said it could have been used to take over admin accounts in firewalls, and take over PAN-OS instances.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors