CVE-2024-5910 — Expedition: Missing Authentication Leads to Admin Account Takeover

Summary

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.

Weakness: CWE-306

Title, description and the vendor's statements are quoted from the CVE record; a vendor's advisory is summarised in Patcharo's words, with a link.

Affected and fixed versions

Per product and release branch, as the vendor's CVE record and official advisory state them. A fixed release is shown only when a document names it: the vendor's, or CERT-FR's for Check Point, with its source.

Remediation

Known exploitation

92% probability of exploitation in the next 30 days (percentile 100%).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CERT-FR

No CERT-FR advisory or alert of the last two years references this CVE, for the vendors Patcharo covers.

Timeline

1. 10 Jul 2024Published by the source
2. 7 Nov 2024Added to CISA KEV
3. 28 Nov 2024CISA remediation due date
4. 17 Jun 2026Source record last modified
5. 27 Sept 2026EPSS score computed
6. 1 Oct 2026Last verified by Patcharo

Official sources

• Palo Alto Networks (CVE record)retrieved 1 Oct 2026 at 13:37 UTC
• CISA Known Exploited Vulnerabilitiesretrieved 1 Oct 2026 at 13:37 UTC
• NVDretrieved 27 Sept 2026 at 23:44 UTC
• FIRST EPSSretrieved 27 Sept 2026 at 23:46 UTC

Palo Alto Networks · CISA Known Exploited Vulnerabilities · NVD · FIRST EPSS