Tracked as CVE-2024-5910 (CVSS score of 9.3), the security defect is described as a missing authentication for a critical function, which could allow attackers to take over administrative accounts. Palo Alto Networks addressed the flaw in Expedition version 1.2.92.

On Wednesday, the cybersecurity giant also resolved a high-severity arbitrary file upload issue in Panorama software that could lead to a denial-of-service (DoS) condition.

Tracked as CVE-2024-5911, the vulnerability requires that an attacker is authenticated to the web interface as a read-write administrator.

“Repeated attacks eventually cause the Panorama to enter maintenance mode, which requires manual intervention to bring the Panorama back online,” Palo Alto Networks explained.

The company also released patches for medium-severity security defects in Cortex XDR agent and PAN-OS software that could allow attackers to run untrusted code on a device and to tamper with the physical file system to elevate privileges, respectively.

Palo Alto Networks also published an advisory on Wednesday detailing the impact of the recently disclosed BlastRADIUS vulnerability on its PAN-OS firewalls configured to use the CHAP or PAP protocols for authentication with a RADIUS server.

“This vulnerability allows an attacker performing a meddler-in-the-middle attack between Palo Alto Networks PAN-OS firewall and a RADIUS server to bypass authentication and escalate privileges to ‘superuser’ when RADIUS authentication is in use and either CHAP or PAP is selected in the RADIUS server profile,” the company explained.