CVE-2022-0028: Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability

CVE-2022-0028 is a reflected amplification denial-of-service vulnerability in Palo Alto Networks PAN-OS. A misconfiguration in URL filtering policy can let a network-based attacker bounce and amplify TCP traffic, turning the firewall into a reflector that helps flood a target. It matters because devices meant to protect the network can instead be abused to disrupt availability elsewhere, and the impact depends on how URL filtering is configured.

Public detail is limited to the CISA description and the assigned weakness; confirm exact conditions, fixed releases, and any configuration prerequisites directly against the vendor advisory.

How it works

The underlying weakness is CWE-940 (improper verification of the source of a communication channel). In this case, a URL filtering policy misconfiguration on PAN-OS can cause the device to respond to crafted requests in a way that reflects and amplifies TCP traffic toward a victim chosen by the attacker.

An attacker on the network sends traffic that the firewall processes under the misconfigured policy. Instead of dropping or properly validating the source, the device generates larger or more numerous responses directed at the attacker-specified target. The result is a reflected denial-of-service (RDoS) condition that consumes bandwidth or resources on the victim side. No further exploit mechanics are provided in the public summary; treat any deeper technical claims as unconfirmed until verified in the vendor advisory.

Am I affected? How to find it in your systems

PAN-OS runs on Palo Alto Networks next-generation firewalls and related security appliances, commonly deployed at internet edges, data-center perimeters, and segment boundaries. Inventory every firewall, panorama-managed device, and virtual PAN-OS instance in your environment.

• List all PAN-OS devices via your management console, CMDB, or network discovery; record the running software version and whether URL filtering is enabled.
• Review URL filtering policy objects and security rules that reference them. Look for configurations that could allow the device to generate unsolicited or amplified TCP responses; the precise misconfiguration pattern must be confirmed against the vendor advisory.
• Check whether the devices are reachable from untrusted networks, because the attack is described as network-based.
• Telemetry signs of abuse may include unusual spikes in TCP sessions or outbound traffic volume originating from the firewall itself, especially toward unexpected external destinations. Correlate firewall session logs, threat logs, and interface counters for anomalous reflection patterns. Absence of such logs does not prove safety; confirm version and policy state first.

How to remediate

Patch first. Apply the updates published by Palo Alto Networks for CVE-2022-0028 exactly as described in the vendor advisory and follow CISA’s direction to apply updates per vendor instructions.

• Schedule and deploy the fixed PAN-OS releases through your normal change process; verify the new version is running on every affected device.
• After patching, re-validate URL filtering policies so they no longer permit the reflection condition. Remove or tighten any rules that were identified as contributing to the misconfiguration.
• For this class of flaw, enforce strict source validation on policies that generate responses, limit URL filtering to only the traffic that requires it, and ensure anti-spoofing and egress filtering are active so the firewall cannot be used as an open reflector.
• Document the change and retain evidence of the version upgrade for compliance and audit purposes.

If you can't patch immediately

Reduce exposure until the vendor update can be applied.

• Segment management and data-plane interfaces so that untrusted networks cannot reach the URL-filtering path that triggers the issue.
• Temporarily disable or bypass URL filtering on rules that face untrusted zones if business needs allow; replace with more restrictive allow-lists where possible.
• Apply virtual patching or external rate-limiting (network ACLs, upstream scrubbing, or DoS-protection profiles) to drop or throttle the traffic patterns that would elicit amplified responses.
• Increase monitoring of session tables, outbound connection rates, and CPU/memory on the firewalls; alert on sudden increases in reflected TCP traffic.
• Ensure anti-spoofing (uRPF or equivalent) and strict egress filtering are enabled so spoofed sources cannot easily abuse the device.

If your data may have been exposed

This vulnerability is a denial-of-service issue; the public record does not document ransomware use or direct data exfiltration. Actively exploited vulnerabilities can still lead to broader incidents if an attacker uses the disruption as cover or pivots afterward. If you suspect compromise, follow your incident-response plan, preserve logs, and review adjacent systems. You can also run a free exposure scan of your email addresses against known breach data sets to check whether credentials or personal information have appeared in prior breaches.