Following proof of ongoing assaults, the U.S. Cybersecurity Agency (CISA) added a significant security hole in Palo Alto Networks Expedition to its list of known exploitable vulnerabilities.

The Expedition migration program has a Palo Alto vulnerability known as CVE-2024-5910 (CVSS score: 9.3) that involves a situation of missing authentication that might result in an admin account takeover.

An attacker with network access might take over an Expedition admin account and perhaps obtain credentials, configuration secrets, and other data due to missing authentication vulnerability in Palo Alto Expedition, according to a warning from CISA.

The bug affects all versions of Expedition up until version 1.2.92, which was released in July 2024 to address the problem.

Although there aren't any indications on how the vulnerability is being used as a weapon in actual assaults, Palo Alto Networks has subsequently updated its first warning to include that it is aware of CISA reports indicating ongoing exploitation.

Two other vulnerabilities have also been added to the KEV catalog, including privilege escalation vulnerability in the Android Framework component (CVE-2024-43093) that Google revealed last week as being subject to "limited, targeted network exploitation."

CVE-2024-51567 (CVSS score: 10.0), a major CyberPanel vulnerability, is the other security issue that permits a remote, unauthenticated attacker to run commands as root. This problem has been fixed in version 2.3.8.

LeakIX and a security researcher known online as Gi7w0rm claim that it was discovered in late October 2023 that malicious actors were extensively exploiting the vulnerability to infect more than 22,000 internet-accessible CyberPanel instances with PSAUX ransomware.

Three different ransomware gangs have swiftly taken advantage of the vulnerability, according to LeakIX, with some data being encrypted more than once.

It is advised that agencies under the Federal Civilian Executive Branch (FCEB) fix the vulnerabilities found by November 28, 2024, in order to protect their networks from ongoing attacks.