PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering (CVE-2022-0028)

What is affected, what to do

A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target.

The vulnerability is being actively exploited; treat it as a priority. Update Palo Alto Networks PAN-OS to version 8.1.23-h1, Palo Alto Networks PAN-OS to version 9.0.16-h3, Palo Alto Networks PAN-OS to version 9.1.14-h4. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Palo Alto Networks PAN-OS lt 8.1..8.1.23-h1
• Palo Alto Networks PAN-OS lt 9.0..9.0.16-h3
• Palo Alto Networks PAN-OS lt 9.1..9.1.14-h4
• Palo Alto Networks PAN-OS lt 10.0..10.0.11-h1
• Palo Alto Networks PAN-OS lt 10.1..10.1.6-h6
• Palo Alto Networks PAN-OS lt 10.2..10.2.2-h2

Fixed in

• Palo Alto Networks PAN-OS 8.1.23-h1
• Palo Alto Networks PAN-OS 9.0.16-h3
• Palo Alto Networks PAN-OS 9.1.14-h4
• Palo Alto Networks PAN-OS 10.0.11-h1
• Palo Alto Networks PAN-OS 10.1.6-h6
• Palo Alto Networks PAN-OS 10.2.2-h2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Audit for the vulnerable configuration first: On every PA-Series, VM-Series and CN-Series firewall, find security rules whose source zone contains an internet-facing interface and that carry a URL Filtering profile with one or more blocked categories. Only that combination is exploitable. Use Panorama or the CLI (show running security-policy) and cross-check profile-setting against the source zones.
   • Remove URL Filtering profiles from inbound rules: URL Filtering belongs on outbound (trust → untrust) traffic. On untrust-sourced rules it is almost certainly a mistake. Detach the profile and commit. This removes the attack surface without a maintenance window.
   • Apply the PAN-OS hotfix: Upgrade to 8.1.23-h1, 9.0.16-h3, 9.1.14-h4, 10.0.11-h1, 10.1.6-h6 or 10.2.2-h2 (or later in the same train). Upgrade HA pairs in the usual order: passive first, then fail over.
   • Out of scope, no action needed: Panorama M-Series and Panorama virtual appliances are not affected. Cloud NGFW and Prisma Access were fixed by the vendor.
   • Engage upstream and abuse channels: If your public firewall IPs show up in abuse reports or blocklists, notify your ISP or upstream provider. The attack makes your firewall look like the attacker, which creates reputational exposure and may trigger NIS2 reporting if third parties are harmed.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration / policy design: Bind URL Filtering profiles only to rules with internal source zones. Add a Panorama config-audit check that flags any new rule pairing an untrust source zone with a URL profile, and track it as a configuration-baseline deviation.
   • Zone Protection (vendor workaround where the profile can't be removed): On the external zone, apply a Zone Protection profile with Packet Based Attack Protection → TCP Drop and enable "TCP SYN with Data" and "TCP SYNACK with Data". The amplification relies on SYN packets carrying an HTTP request that triggers a block page before any handshake completes.
   • Network edge filtering: At the upstream router or anti-DDoS service, drop or rate-limit TCP SYNs with payload aimed at your firewall's public addresses. Use DoS Protection profiles to cap response traffic from the firewall to any single destination.
   • Response-page hardening: Where the business allows it, use reset-both or drop instead of the HTML block page for externally triggered blocks. The response page is what provides the amplification.
   • Patch governance: Put the 8.1 and 9.0 trains on the retirement roadmap. Perimeter firewalls are critical assets and should sit inside the tightest patch SLA in your ISMS.
3. 03

   Runbook step 3

   Detection rules

   • PAN-OS URL Filtering logs: Look for bursts of action=block-url with from_zone set to the external zone and many varied (likely spoofed) source IPs. SPL: index=pan sourcetype=pan:threat log_subtype=url action=block-url src_zone=untrust | stats count by src_ip, url_category | where count>100
   • Zeek weird.log: Look for spikes of name=="SYN_with_data" targeting your firewall IPs, the hallmark of middlebox amplification. Suricata: a rule matching flags:S; dsize:>0; toward your public firewall prefix.
   • NetFlow/IPFIX at the perimeter: Look for asymmetric flows where small inbound SYNs are followed by much larger outbound traffic from the firewall to a single external host, with no completed handshake.
   • Config monitoring: Alert on Panorama config-log entries or commit audits that attach a url-filtering profile to an untrust-sourced rule. Sigma shape: logsource: paloalto config; selection: cmd=set, path|contains: 'profile-setting', zone: untrust.
   • External signals: Watch for abuse complaints, Shadowserver or national CERT reports, or DDoS complaints that name your firewall IPs as the source.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Palo Alto Networks Pan-os
• Palo Alto Networks Palo Alto Networks PAN-OS

Weakness classes (CWE)

• CWE-406Insufficient Control of Network Message Volume (Network Amplification)

  Class

  The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

  Entry at MITRE CWE-406

References & sources

• security.paloaltonetworks.comCVE-2022-0028x_refsource_MISC, Mitigation, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0028government-resource, US government resource