Palo Alto Networks PAN-OS URL Filtering Misconfiguration Reflected TCP Denial-of-Service Vulnerability (CVE-2022-0028) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTPalo Alto Networks PAN-OS firewalls (PA-Series, VM-Series, CN-Series) configured with a URL filtering profile containing blocked categories assigned to a source zone with an external-facing interface.
Remote attackers can abuse the firewall as a reflector and amplifier to launch high-volume TCP Reflected Denial-of-Service (RDoS) attacks against arbitrary targets, masking their identity.
Apply official PAN-OS software updates immediately, or review and remove URL filtering profiles from security policies applied to external-facing source zones.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Access the PAN-OS CLI to verify the current software version and upgrade to a patched release.
# Check current PAN-OS version
show system info | match sw-version
# Download and install the patched software version (e.g., 10.1.6-h6 or later)
request system software download version 10.1.6-h6
request system software install version 10.1.6-h6
# Reboot the system to apply the patch
request restart system2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, inspect security policies and remove URL filtering profiles from rules that have external-facing interfaces in their source zones.
# Enter configuration mode
configure
# Remove or modify the URL filtering profile from the vulnerable security rule
delete rulebase security rules <Rule-Name> profile-setting profiles url-filtering
# Commit the changes
commit3. Log Audit & IoC Verification Commands
Monitor firewall session tables and global counters to detect anomalous TCP traffic patterns or excessive discarded sessions.
# Check for an abnormal volume of discarded sessions
show session all filter type predict state discard
# Monitor global counters for dropped or reset packets
show counter global filter category flow | match 'drop|deny|reset'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-0028) is a design and configuration flaw in Palo Alto Networks PAN-OS software when processing URL filtering policies. Under specific conditions, the firewall inappropriately responds to incoming TCP requests by reflecting and amplifying traffic. The root cause lies in a configuration where a URL filtering profile with one or more blocked categories is assigned to a security rule whose source zone includes an external-facing interface. While this is an atypical and unintended configuration for URL filtering, if implemented, it exposes the firewall to exploitation.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates the attack by sending spoofed TCP SYN or handshake packets to the external interface of the vulnerable PAN-OS firewall, forging the source IP address to match the victim's IP address. Upon receiving the packet, the firewall evaluates the traffic against its security policy. Because the source zone is configured with a URL filtering profile that blocks the requested category, the firewall attempts to serve a block page to the spoofed source IP. This triggers a continuous stream of TCP response packets directed at the victim, resulting in a high-volume Reflected and Amplified Denial-of-Service (RDoS) attack leveraging the firewall's high-throughput capacity.
3. Infrastructure & Business Impact
Exploitation of this vulnerability does not compromise the confidentiality, integrity, or availability of the PAN-OS firewall itself. However, it allows the firewall to be weaponized as an attack vector against external entities. This can lead to the organization's public IP addresses being blacklisted, causing severe reputational damage. Additionally, the generation of massive amplification traffic can exhaust firewall session tables and saturate network bandwidth, indirectly causing service degradation for legitimate internal users. Due to active exploitation in the wild, this vulnerability is listed in the CISA KEV catalog.
Official Vendor Advisories & References
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.
Frequently Asked SecOps Questions (CVE-2022-0028)
FAQQ1. How critical is CVE-2022-0028 and is it actively exploited in the wild?
CVE-2022-0028 is rated CVSS 8.6 (HIGH) with a 30-day EPSS exploitation probability of 2.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-0028?
Primary impacted vendors include paloaltonetworks across pan-os. Scope summary: PAN-OS 10.2 (prior to 10.2.2-h2), PAN-OS 10.1 (prior to 10.1.6-h6), PAN-OS 10.0 (prior to 10.0.11-h1), PAN-OS 9.1 (prior to 9.1.14-h4), PAN-OS 9.0 (prior to 9.0.16-h3), and PAN-OS 8.1 (prior to 8.1.23-h1) running on PA-Series, VM-Series, and CN-Series firewalls.
Q3. What temporary mitigations or workarounds exist for CVE-2022-0028 before patching?
[Mitigation] Apply official PAN-OS software updates immediately, or review and remove URL filtering profiles from security policies applied to external-facing source zones. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-0028
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (paloaltonetworks)
View Category →Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).
Palo Alto Networks PAN-OS Management Interface Remote Code Execution (RCE) Vulnerability (CVE-2026-0322)
[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.