CVE-2024-9465 Palo Alto Networks Expedition SQL Injection

Exploited in the wild Critical 9.2 Published 9 Oct 2024 Updated 21 Oct 2025

Unauthenticated attackers can exploit SQL injection to steal credentials and execute arbitrary code on Palo Alto Expedition servers.

Exploited in the wild: Since 14 Nov 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-9465?

CVE-2024-9465 is a critical SQL injection vulnerability in Palo Alto Networks Expedition, published on 9 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.

Weakness: CWE-89

Which versions are affected by CVE-2024-9465?

It affects 1 product.

Products include Paloaltonetworks Expedition.

How do I fix CVE-2024-9465?

No fix has been published for CVE-2024-9465 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Dec 2024.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-9465 being exploited?

Yes. Attackers have exploited CVE-2024-9465 in the wild since at least 14 Nov 2024.

Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.

Sources

Also known as GHSA-9f2c-45xq-c486.