CISA Issues Urgent Directive as Palo Alto Networks PAN-OS Flaw Under Active Exploitation

Federal and public sector IT security teams are facing a race against time following an urgent directive issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The agency has mandated that all federal civilian agencies apply critical software patches to vulnerable Palo Alto Networks firewalls by September 9, warning that a high-severity vulnerability tracked as CVE-2022-0028 is currently being actively exploited in the wild.

The flaw resides within PAN-OS, the proprietary operating system powering Palo Alto Networks’ widely deployed line of hardware, virtual, and containerized firewalls. According to advisories from both the vendor and federal authorities, unauthenticated remote attackers are leveraging the security loophole to orchestrate large-scale reflected and amplified denial-of-service (DoS) attacks. While the software vendor initially released remediation patches earlier in the month, mounting intelligence regarding active exploitation has forced CISA to elevate its response, placing the bug directly onto its heavily watched Known Exploited Vulnerabilities (KEV) Catalog and signaling an acute risk to enterprise and governmental networks alike.

Anatomy of the Vulnerability: CVE-2022-0028

Discovered and subsequently patched by Palo Alto Networks, CVE-2022-0028 is classified as a high-severity flaw carrying a CVSS base score of 8.6. The vulnerability itself stems from a potential misconfiguration within the PAN-OS URL filtering policy. Specifically, the flaw can be triggered when a firewall is configured with a URL filtering profile containing one or more blocked categories, and that profile is assigned to a security rule featuring a source zone with an externally facing network interface.

Under these precise conditions, an unauthenticated, network-based attacker can manipulate the system to conduct sophisticated reflected and amplified TCP denial-of-service (RDoS) attacks. Crucially, the resulting malicious traffic does not appear to originate from the attacker’s infrastructure. Instead, the compromised Palo Alto Networks firewall acts as an unwitting amplifier, projecting the flood of data toward a targeted victim while masking the true origin of the assault.

Despite the severity of the potential impact, Palo Alto Networks has maintained that successful exploitation requires this exact, non-standard configuration—one that security architects generally consider unintended. The vendor emphasizes that the vulnerability cannot be exploited on default or properly hardened firewall installations. Nevertheless, the presence of these misconfigurations across diverse enterprise and public sector environments has provided adversaries with enough traction to warrant immediate, widespread defensive action.

Comprehensive Impact and Affected Software Versions

The scope of potential exposure spans multiple generations of Palo Alto Networks infrastructure. Devices running vulnerable iterations of PAN-OS include the hardware-based PA-Series, virtualized VM-Series, and container-based CN-Series firewalls.

Organizations running older, unsupported, or unpatched versions of the operating system are at the highest risk. According to the official vendor advisory, specific PAN-OS software branches requiring immediate remediation include:

• PAN-OS versions prior to 10.2.2-h2
• PAN-OS versions prior to 10.1.6-h6
• PAN-OS versions prior to 10.0.11-h1
• PAN-OS versions prior to 9.1.14-h4
• PAN-OS versions prior to 9.0.16-h3
• PAN-OS versions prior to 8.1.23-h1

Administrators utilizing these versions are urged to audit their active configurations immediately to determine if any security rules meet the vulnerable criteria, followed by the prompt deployment of the relevant hotfixes provided by Palo Alto Networks.

Chronology of Events and CISA Intervention

The timeline surrounding CVE-2022-0028 highlights the accelerated pace at which software vulnerabilities move from discovery to active weaponization by threat actors.

• Early August 2022: Palo Alto Networks quietly identifies the flaw during internal security reviews and formulates patches. The company releases security advisories alongside updated PAN-OS builds designed to mitigate the underlying logic error in the URL filtering policy handling.
• Mid-August 2022: Threat intelligence feeds begin registering telemetry indicating that malicious actors have reverse-engineered the vulnerability and are actively scanning for misconfigured firewalls to draft into botnets or utilize for reflection attacks.
• Late August 2022 (Monday): Recognizing the active campaign and the systemic risk posed by perimeter network devices falling victim to RDoS campaigns, CISA formally adds CVE-2022-0028 to its KEV Catalog.
• September 9, 2022: CISA establishes a hard compliance deadline for federal civilian executive branch (FCEB) agencies to apply the necessary patches or remove the vulnerable devices from operational networks.

CISA’s KEV Catalog serves as an authoritative industry benchmark, prioritizing remediation efforts for vulnerabilities that carry verified exploitation data. By adding the Palo Alto Networks flaw to this catalog, the agency effectively signaled to both public and private sectors that passive defense is no longer sufficient; active, prioritized patching is mandatory to prevent widespread degradation of internet infrastructure.

Understanding Reflected and Amplified Denial-of-Service (RDoS) Attacks

To fully grasp why federal regulators and cybersecurity experts are treating CVE-2022-0028 with such urgency, it is necessary to examine the mechanics of Reflected and Amplified TCP Denial-of-Service attacks.

Traditional volumetric DDoS attacks often rely on compromised endpoints—such as IoT devices comprising a botnet—to hammer a target server with direct requests until its computing resources are exhausted. While effective, these attacks require massive botnet infrastructure to generate significant bandwidth. In contrast, reflection and amplification techniques allow threat actors to manufacture catastrophic volumes of disruptive traffic while utilizing minimal computational resources of their own.

In the context of the Palo Alto Networks vulnerability, the attack vector leverages TCP protocol mechanics. An adversary initiates the sequence by sending a spoofed SYN packet to a vulnerable firewall acting as a reflector. Crucially, the source IP address within the packet header is forged to match the IP address of the ultimate victim, rather than the attacker’s actual location.

Upon receiving the spoofed SYN packet, the firewall processes the request according to its misconfigured URL filtering rules and responds with a SYN-ACK packet directed straight at the victim. If the victim’s server never acknowledges this SYN-ACK—which is typical in a spoofed scenario—the reflector service will dutifully attempt to retransmit the packet multiple times, per standard networking protocols.

By scaling this process across multiple misconfigured firewalls and manipulating retransmission parameters, an attacker can achieve a massive amplification factor. The victim is suddenly inundated with a blinding tempest of SYN-ACK packets originating from trusted corporate and government network perimeters, severely disrupting legitimate business operations, degrading customer service portals, and potentially knocking critical digital infrastructure completely offline.

Broader Industry Implications and Enterprise Risk

The active exploitation of CVE-2022-0028 underscores a sobering reality in modern cybersecurity: network security infrastructure, designed specifically to protect organizations from external threats, can occasionally become the very vector through which those threats are realized.

Firewalls sit at the critical boundary between trusted internal networks and the untrusted public internet. Because they are designed to handle massive throughput and inspect deep packets at line rate, any architectural flaw or subtle misconfiguration in their core operating logic can have disproportionate consequences. When an enterprise firewall is successfully weaponized into an RDoS amplifier, the collateral damage extends far beyond the individual organization. It contributes to a broader ecosystem degradation where core internet routing infrastructure is strained by synthetic noise.

Furthermore, the rapid transition of CVE-2022-0028 from a newly disclosed advisory to an actively exploited zero-day highlights the diminishing window of time administrators have to secure their perimeters. Threat actors routinely monitor vulnerability disclosures, rapidly developing automated scripts to scan the global IP space for unpatched systems within hours of a patch release.

Recommended Mitigation and Remediation Strategies

Security operations centers (SOCs) and network administrators managing Palo Alto Networks infrastructure are advised to adopt a defense-in-depth approach to neutralize the risks associated with CVE-2022-0028.

1. Immediate Patch Deployment: The primary and most effective remediation step is updating the PAN-OS software to the latest patched versions provided by Palo Alto Networks. Organizations must verify their current version matrix against the vendor’s advisory list and schedule maintenance windows to apply the requisite maintenance releases (such as 10.2.2-h2, 10.1.6-h6, 10.0.11-h1, and corresponding legacy branch patches).
2. Configuration Auditing: Because the vulnerability specifically requires a non-standard URL filtering configuration, administrators should perform comprehensive configuration audits across all PA-Series, VM-Series, and CN-Series devices. Security rules should be checked to ensure that URL filtering profiles with blocked categories are not improperly associated with source zones containing external-facing network interfaces.
3. Strict Ingress and Egress Filtering: Implementing robust ingress and egress filtering at network boundaries—such as BCP 38 compliance—can drastically reduce the effectiveness of IP spoofing techniques required to launch reflection attacks, preventing internal networks from inadvertently participating in broader internet-scale campaigns.
4. Adherence to Federal Directives: For federal agencies and contractors bound by CISA mandates, compliance with the September 9 deadline is non-negotiable. Continuous monitoring and automated vulnerability assessment tools should be leveraged to ensure no stray instances of vulnerable firmware remain active within federal perimeters.

As cyber threats continue to evolve in both volume and sophistication, incidents involving core infrastructure components like PAN-OS serve as a stark reminder of the perpetual tension between software complexity and enterprise resilience. Prompt patch management, rigorous configuration hygiene, and close alignment with official intelligence advisories remain the bedrock of an effective defensive posture in an increasingly hostile digital landscape.