#expedition

Field Note · Jun 23, 2026 · Colten Anderson

The migration tool you finished with in October is still holding your firewall passwords

Expedition stores cleartext PAN-OS admin credentials for every firewall it ever touched. Three critical CVEs, two of them actively exploited, and the tool went EOL in December. If it's still running, it's a credential dump waiting to happen.