Palo Alto Networks

CVE-2025-0107: Expedition: OS Command Injection Vulnerability

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 25 Jun 2025. It cites 162 public reports, the first from 25 Jun 2025. VulnCheck's own honeypots also recorded exploitation attempts.

How likely is exploitation in the next 30 days?

78.4%

EPSS score, percentile 99.6 of all scored records. A probability estimated by FIRST, not a report of exploitation.

CISA's SSVC assessment in the CVE record lists exploitation as poc.

How severe?

7.7 High

CVSS v4.0 base score, given by the CNA

What should I do?

This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition. * Expedition reached its End of Life (EoL) date … Full textSolution from the CVE record.

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (1)

Which versions are affected?

Affected

from 1 to before 1.2.100

Unaffected All; from 1.2.100; All; All; All

Versions by product

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 29 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

Expedition: OS Command Injection Vulnerability

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

security.paloaltonetworks.com (Vendor advisory)

Solution (from the CVE record)

This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition. * Expedition reached its End of Life (EoL) date https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 and is no longer supported. We added these fixes prior to the EoL date and we do not plan to make any additional updates or security fixes. Please use the suggested alternatives listed in the Expedition End of Life Announcement https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 .

Workaround (from the CVE record)

Ensure that all network access to Expedition is restricted to only authorized users, hosts, and networks. If you are not actively using Expedition, make sure that your Expedition software is shut down.

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.