CISA warns of more Palo Alto Networks bugs exploited in attacks

**Critical vulnerabilities in Palo Alto Networks Expedition are being actively exploited.** Two unauthenticated flaws (a command injection and an SQL injection) allow attackers to execute arbitrary commands as root and access or modify Expedition database contents—exposing usernames, cleartext passwords, device configurations, and API keys—potentially enabling firewall account takeover. CISA added the CVEs to its Known Exploited Vulnerabilities catalog and mandated federal patching; Palo Alto released fixes in Expedition 1.2.96+ and recommends restricting access and rotating credentials.