Palo Alto Expedition: Exploited Bugs in an EOL Firewall Tool
Expedition has been end of life since December 31, 2024 and should not be running; if you find one, shut it down and rotate every firewall credential and API key it ever held.
Must act: Anyone who used Expedition to migrate or tune firewall configs and may still have the VM running, especially if it was reachable from the internet or a broad internal network before 1.2.96.
Can relax: Organizations that never used Expedition, or that shut it down and rotated the credentials it processed. PAN-OS firewalls, Panorama, Prisma Access and Cloud NGFW are not affected.
- Search VM inventories, hypervisors and scan results for any Expedition server that still exists.
- Shut down and archive any Expedition VM; Palo Alto Networks says it is meant for temporary migration use, not production.
- Rotate every firewall and Panorama admin password and API key that was ever imported into Expedition.