CVE-2025-0104: Palo Alto Networks Expedition

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

Affected products

• Palo Alto Networks Expedition: before 1.2.101 (fixed in 1.2.101)

Published 2025-01-11. Last modified 2026-06-17.