The vulnerability identified as CVE-2022-0028 in Palo Alto Networks' PAN-OS firewall software enables a network-based attacker to exploit a URL filtering policy misconfiguration to launch reflected and amplified TCP denial-of-service attacks. These attacks cause the firewall to send amplified traffic to a victim, effectively using the firewall as a reflector and amplifier in a denial-of-service attack. Exploitation requires a specific firewall configuration where a URL filtering profile with blocked categories is assigned to a security rule with a source zone that has an external-facing network interface. The affected products include PA-Series hardware, VM-Series virtual, and CN-Series container firewalls running vulnerable PAN-OS versions. Palo Alto Networks has released patches for multiple PAN-OS versions to address this issue. CISA has added this vulnerability to its KEV catalog and strongly recommends remediation.

Successful exploitation allows remote attackers to leverage vulnerable PAN-OS firewalls to conduct reflected and amplified TCP denial-of-service attacks against third-party targets without authentication. This can result in significant disruption to targeted networks or services by overwhelming them with amplified traffic. The vulnerability does not allow direct compromise of the firewall or its configuration but enables misuse of the firewall as a tool in denial-of-service attacks. The attack requires a specific non-standard firewall configuration, which is likely unintended by administrators. No additional exploitation beyond denial-of-service amplification has been reported.

Palo Alto Networks has released official patches for PAN-OS versions prior to 10.2.2-h2, 10.1.6-h6, 10.0.11-h1, 9.1.14-h4, 9.0.16-h3, and 8.1.23-h1. Organizations should apply these patches immediately to affected systems. The vulnerability requires a specific URL filtering policy configuration; reviewing and correcting firewall configurations to avoid assigning URL filtering profiles with blocked categories to security rules with external-facing source zones can mitigate risk. CISA strongly recommends prioritizing remediation of this vulnerability. Patch status is confirmed as official fixes are available.