CVE-2022-0028 Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service

Exploited in the wild High 8.6 Published 10 Aug 2022 Updated 21 Oct 2025

Misconfigured URL filtering allows attackers to launch reflected DoS attacks, implicating the firewall as the source.

Exploited in the wild: Since 22 Aug 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-0028?

CVE-2022-0028 is a high-severity denial of service vulnerability in Paloaltonetworks Pan-Os, published on 10 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.

Weakness: CWE-406

Which versions are affected by CVE-2022-0028?

It affects 1 product.

Products include Paloaltonetworks Pan-Os.

How do I fix CVE-2022-0028?

No fix has been published for CVE-2022-0028 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 12 Sep 2022.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-0028 being exploited?

Yes. Attackers have exploited CVE-2022-0028 in the wild since at least 22 Aug 2022.

All Paloaltonetworks Pan-Os vulnerabilities

Sources

Also known as GHSA-r3j6-h9rm-9q33.