CISA Urges Urgent Patching of Palo Alto Networks PAN-OS Following Active Exploitation of High-Severity Denial-of-Service Vulnerability

The United States Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive to federal agencies and private sector IT administrators, mandating the immediate remediation of a high-severity security flaw impacting Palo Alto Networks’ PAN-OS firewall software. The vulnerability, tracked as CVE-2022-0028, has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, signaling that the flaw is no longer a theoretical risk but is actively being weaponized by malicious actors in the wild. Federal civilian executive branch agencies have been given a strict deadline of September 9 to apply the necessary security updates to their infrastructure.

The vulnerability stems from a misconfiguration within the URL filtering policy of the PAN-OS platform. If a firewall is improperly configured with a URL filtering profile—specifically one that assigns blocked categories to a security rule where the source zone utilizes an external-facing network interface—it becomes susceptible to exploitation. By leveraging this oversight, remote, unauthenticated attackers can orchestrate reflected and amplified Transmission Control Protocol (TCP) denial-of-service (DoS) attacks. These attacks effectively weaponize the firewall itself, forcing it to generate massive, disruptive traffic flows toward an attacker-specified target.

Chronology of the Vulnerability and Response

The discovery and subsequent disclosure of CVE-2022-0028 followed a standard but high-pressure timeline common in the cybersecurity industry. Palo Alto Networks first identified the issue earlier this month, recognizing that while the potential for abuse was significant, the conditions required for a successful exploit were relatively specific. The company moved to release patches across their product lines, which include the widely deployed PA-Series hardware firewalls, the VM-Series virtual firewalls, and the CN-Series container firewalls.

Following the vendor’s advisory, the cybersecurity community began monitoring for signs of exploitation. Reports soon emerged that adversaries were attempting to capitalize on the flaw. This prompted CISA to intervene on Monday, formally adding the bug to its KEV catalog. This catalog serves as the definitive government-backed repository for vulnerabilities that are currently being leveraged in real-world attacks. By including CVE-2022-0028, CISA underscored the severity of the threat, moving it from a standard vendor-patch cycle to a mandatory compliance event for federal entities.

Technical Scope and Affected Product Versions

The scope of the affected software is broad, spanning various iterations of the PAN-OS operating system. Organizations running any of the following versions are urged to verify their status and upgrade immediately:

• PAN-OS versions prior to 10.2.2-h2
• PAN-OS versions prior to 10.1.6-h6
• PAN-OS versions prior to 10.0.11-h1
• PAN-OS versions prior to 9.1.14-h4
• PAN-OS versions prior to 9.0.16-h3
• PAN-OS versions prior to 8.1.23-h1

Palo Alto Networks has been clear in its guidance: the vulnerability is not a default state of the software but rather an outcome of a non-standard, likely unintended configuration. The company emphasizes that the vulnerability resides in the interaction between a specific URL filtering profile and an external-facing interface. While the vendor notes that the number of systems meeting these exact, risky criteria is limited, the sheer volume of Palo Alto Networks firewalls deployed in enterprise and government environments globally means that even a small percentage of vulnerable devices represents a significant attack surface.

Understanding Reflected and Amplified DoS Attacks

The nature of the attack enabled by CVE-2022-0028 is particularly concerning due to its ability to obscure the perpetrator while maximizing the destructive potential of the traffic. In a standard denial-of-service attack, the primary challenge for the attacker is generating enough volume to overwhelm the target’s bandwidth or processing power. By employing "reflection" and "amplification," attackers can bypass these limitations.

In the case of this TCP-based attack, the adversary initiates a request by sending a spoofed SYN packet to the targeted firewall. Crucially, the attacker replaces the original source IP address in the packet header with the IP address of the intended victim. When the firewall receives this packet, it follows its configured security policy—which, due to the misconfiguration, is instructed to send a response. The firewall then sends a SYN-ACK packet to the victim. Because the victim never initiated the original connection, the firewall’s response is unexpected.

The process becomes an "amplified" attack if the firewall retransmits the SYN-ACK packet multiple times in an attempt to establish a connection that the victim will never acknowledge. By sending a flood of these spoofed requests to multiple reflection points (the firewalls), an attacker can turn a relatively small amount of outbound malicious traffic into a massive, concentrated stream of traffic hitting the victim. The victim is not only overwhelmed by the sheer volume of junk data, which consumes server resources and prevents legitimate users from accessing services, but they are also unable to easily trace the source of the traffic, as the packets appear to originate from legitimate, trusted firewall devices.

Broader Implications for Network Security

The emergence of this vulnerability highlights a recurring theme in modern cybersecurity: the danger of "configuration drift" and the complexity of managing high-performance security appliances. In an era where firewalls are tasked with deep packet inspection, TLS decryption, and complex URL filtering, the potential for human error in policy configuration is high. When a vendor’s security feature—intended to protect the network—is inverted to act as an unwitting participant in a cyberattack, the consequences can be systemic.

The use of networking hardware as a proxy for malicious traffic is not a new concept, but it is one that continues to evolve. In previous years, researchers have noted that DNS, NTP, and SSDP protocols were the primary targets for reflection attacks. Today, the focus has shifted toward any internet-facing device that performs a "handshake" or response operation. This evolution forces network administrators to move beyond basic perimeter defense and adopt a posture of "configuration hygiene," which involves regular audits of security policies to ensure that no rules inadvertently expose the internal network or the appliance itself to the public internet.

Analysis of the CISA Directive

CISA’s intervention in this matter reflects a shift in how federal agencies manage risk. By mandating a patch by a specific date, the agency is attempting to close the "window of opportunity" that exists between the disclosure of a vulnerability and the widespread adoption of the fix by administrators. For many organizations, the lag between a vendor releasing a patch and the IT team deploying it can be weeks or even months. During this time, threat actors perform automated scans to identify unpatched systems, effectively turning the internet into a target-rich environment.

The inclusion of CVE-2022-0028 in the KEV catalog serves as a wake-up call for the private sector as well. While the mandate technically applies to federal civilian agencies, CISA strongly recommends that all private organizations, particularly those in critical infrastructure sectors such as energy, finance, and telecommunications, prioritize the remediation of these vulnerabilities. The potential for these firewalls to be used in large-scale volumetric attacks means that even organizations not directly targeted by the exploit could find their bandwidth and service availability degraded if they are used as part of a larger, coordinated reflection network.

Recommendations and Best Practices

To mitigate the risks associated with CVE-2022-0028, security teams should take a multi-layered approach. First and foremost, the immediate application of the vendor-provided patches is non-negotiable. Beyond patching, organizations must conduct a thorough audit of their security rules and URL filtering profiles. Any policy that includes an external-facing interface and blocked categories should be evaluated for necessity.

Furthermore, network administrators are encouraged to implement "anti-spoofing" measures, such as BCP 38, which helps prevent the transmission of packets with spoofed source IP addresses. By validating the source of traffic at the network edge, organizations can significantly reduce the efficacy of reflection-based attacks.

As the threat landscape continues to grow more complex, the ability of organizations to respond to vendor advisories with speed and precision will remain the primary defense against state-sponsored actors and cyber-criminal groups. The Palo Alto Networks incident serves as a critical reminder that in the interconnected world of enterprise security, the configuration of the gatekeeper is just as important as the strength of the lock. With the September 9 deadline approaching, the focus must remain on ensuring that these essential security devices are not only up-to-date but also correctly configured to withstand the sophisticated techniques employed by modern threat actors.