Is CVE-2024-5910 (Palo Alto Networks Expedition Missing Authentication) being exploited in the wild?

What makes CVE-2024-5910 an exploitation issue, not just a patching issue?

The practical answer is that this is not merely a version-check problem. A missing authentication flaw in an internet-reachable administrative product can turn into immediate account takeover, and once an attacker reaches the admin plane the blast radius often includes configuration data, stored secrets and credentials that were never meant to be externally visible.

For this kind of issue, the first question is whether the product is exposed to any network segment an attacker can reach and whether administrative access is separated from general user access. If the answer is yes, treat the vulnerability as a potential entry point for both direct compromise and follow-on secret exposure.

That is why CISA KEV status matters here: the catalogue exists for vulnerabilities with reliable evidence of active exploitation, so the operational focus shifts from theoretical risk to confirmed exposure. CISA Known Exploited Vulnerabilities Catalog is the authoritative source for that prioritisation signal, while the vendor advisory remains the place to verify the exact affected scope and fix path.

Because Expedition can hold configuration secrets and credentials, the security question extends beyond the application itself. If attackers can reach those values, they may use them to pivot into adjacent systems, re-enter later through trusted integrations, or harvest enough environment detail to make subsequent attacks easier.

What should defenders verify before treating the system as safe?

Start with exposure, then move to control of the admin boundary. Confirm whether any Expedition instance is reachable from untrusted networks, whether administrative interfaces are restricted, and whether there is any evidence that credentials or secrets stored in the product could have been viewed or exported before the vulnerability was addressed.

Verification should also include whether the system was used as a source of truth for passwords, API keys, certificates, VPN material, or migration data. If Expedition ever handled that kind of information, the response should not stop at patching because the secret value may already have been copied out.

For vulnerability triage and incident response, use the NIST National Vulnerability Database and the CVE Program to anchor recordkeeping, then use vendor guidance to map your specific deployment to the relevant fix. That combination helps avoid two common errors: assuming all installations are equally exposed, or assuming that a patch alone closes the incident.

When the vulnerable system stored any reusable secret material, the safer assumption is that those values are compromised until proven otherwise. In practice, that means checking for downstream use of the same credentials elsewhere and looking for signs of authentication attempts that do not line up with normal administration patterns.

How should teams respond if patching cannot happen immediately?

If immediate remediation is not possible, the right fallback is to reduce reachability and remove administrative trust paths. Limit network access to the management interface, isolate the appliance or server from user-facing segments, and place compensating controls around any stored credentials or secrets that could be disclosed if the vulnerability is exercised.

Temporary compensating controls only work if they are paired with monitoring. Watch for new admin sessions, unusual configuration exports, unexpected authentication events, and any changes to credentials that would suggest an attacker used the product as a stepping stone.

For operational prioritisation, the FIRST EPSS service is useful as a supplemental signal, but KEV status should dominate because it indicates known exploitation rather than just elevated likelihood. That distinction matters when you are deciding whether to defer patching for business reasons.

Do not wait for proof of abuse before rotating anything the product may have exposed. If Expedition held admin credentials or related secrets, rotate them and review adjacent systems for the same material, because compromise often extends beyond the original host.

Risk and Threat Considerations

The main risk is not only administrative takeover, but the trust collapse that follows when an attacker inherits stored secrets and configuration data from a management platform. That can turn one externally reachable flaw into broader access across the environment.

Failure mechanism: Missing authentication lets an attacker reach privileged functions, then extract data that supports lateral movement, persistence, or credential reuse in other systems.

Impact: Organisations may face account compromise, loss of confidentiality for configuration data and secrets, and a wider incident scope than the original Expedition deployment.

Practitioner Guidance

What to prioritise: Treat any internet-reachable Expedition deployment as high priority until you have confirmed both patch status and exposure of stored secrets. If administrative access was broadly available, assume the blast radius is larger than the application itself.

What to verify: Confirm whether the product stored reusable credentials, whether those values were reused elsewhere, and whether logs show unusual admin activity, exports, or post-login changes around the exploitation window.

Practitioner takeaway: For management-plane vulnerabilities, the real decision is whether you are only patching software or also resetting trust in everything that software could authenticate to or disclose.

Related resources from NHI Mgmt Group

• Guide: Edge Device Security Guide
• CVE-2024-5910 (Palo Alto Networks Expedition Missing Authentication)
• Is CVE-2024-9465 (Palo Alto Networks Expedition SQL Injection) being exploited in the wild?
• Is CVE-2025-0108 (Palo Alto Networks PAN-OS Authentication Bypass) being exploited in the wild?
• Is CVE-2024-3393 (Palo Alto Networks PAN-OS Malicious DNS Packet) being exploited in the wild?