CVE-2022-0028PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering
Updated under an hour ago ()
Does this affect you?
It affects Palo Alto Networks Cloud NGFW and 3 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Aug 22, 2022; federal agencies had to remediate by Sep 12, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.
- CVSS
- 8.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Weakness (CWE)
- CWE-406
- Known exploited
- Added to CISA KEV Aug 22, 2022; federal remediation due Sep 12, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 2.54% (percentile 85)
- Assigned by
- palo_alto
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Palo Alto Networks Cloud NGFW palo_alto_networks:cloud_ngfw (from the name) | all versions not affected | CNA record |
Palo Alto Networks PAN-OS palo_alto_networks:pan_os (from the name) | from 8.1 before 8.1.23-h1; fixed at 8.1.23-h1; from 9.0 before 9.0.16-h3; fixed at 9.0.16-h3; from 9.1 before 9.1.14-h4; fixed at 9.1.14-h4; from 10.0 before 10.0.11-h1; fixed at 10.0.11-h1; from 10.1 before 10.1.6-h6; fixed at 10.1.6-h6; from 10.2 before 10.2.2-h2; fixed at 10.2.2-h2 | CNA record |
Palo Alto Networks Prisma Access palo_alto_networks:prisma_access (from the name) | 2.1 All not affected; 2.2 All not affected; 3.0 All not affected; 3.1 All not affected | CNA record |
paloaltonetworks pan-os paloaltonetworks:pan-os | from 8.1.0 before 8.1.23-h | CISA ADP |
paloaltonetworks pan-os paloaltonetworks:pan-os | from 8.1.0 before 8.1.23; from 9.0.0 before 9.0.16; from 9.1.0 before 9.1.14; from 10.0.0 before 10.0.11; from 10.1.0 before 10.1.6; from 10.2.0 before 10.2.2; 8.1.23; 9.0.16; and 8 more ranges | NVD |
References
- https://security.paloaltonetworks.com/CVE-2022-0028x-refsource-misc, mitigation, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0028us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.