CISA Issues Urgent Warning as Active Exploits Target Palo Alto Networks PAN-OS Zero-Day Vulnerability

The United States Cybersecurity and Infrastructure Security Agency has issued a mandatory emergency directive compelling federal civilian agencies to immediately apply critical security patches to vulnerable Palo Alto Networks firewalls. The directive follows intelligence confirming that malicious threat actors are actively exploiting a high-severity flaw within the PAN-OS operating system in the wild. The vulnerability, officially cataloged as CVE-2022-0028, carries a severity score and allows remote, unauthenticated attackers to leverage enterprise firewall infrastructure to orchestrate large-scale, reflected, and amplified denial-of-service assaults against third-party targets.

Federal agencies have been given a strict remediation deadline to secure their network perimeters, while private sector organizations operating affected hardware, virtualized, and containerized environments are strongly urged to follow suit. The discovery of these active attacks underscores the persistent threat posed by misconfigured enterprise security controls and highlights the innovative methods malicious actors employ to weaponize core networking equipment.

Chronology of the Vulnerability and Threat Intelligence

The timeline surrounding CVE-2022-0028 began earlier this month when Palo Alto Networks released an out-of-band security advisory detailing a high-severity URL filtering vulnerability within PAN-OS. According to the vendor’s initial technical assessment, the flaw arises from a specific policy misconfiguration wherein a URL filtering profile featuring one or more blocked categories is assigned to a security rule. Crucially, this rule must incorporate a source zone featuring an external-facing network interface. When these precise conditions are met, the firewall inadvertently permits external entities to bounce malicious traffic off the enterprise device.

Security researchers and Palo Alto Networks product security incident response teams identified that malicious actors were actively probing networks for this exact configuration. Recognizing the severity of the threat—specifically the potential for turning corporate firewalls into unwitting participants in massive volumetric botnet attacks—the vendor rushed patches into production across multiple software branches.

Shortly after the disclosure and subsequent patch release, telemetry data captured by threat intelligence groups indicated that scanning activity had transitioned into active exploitation attempts. Recognizing the escalation from reconnaissance to weaponization, the Cybersecurity and Infrastructure Security Agency intervened. On Monday, CISA formally added CVE-2022-0028 to its authoritative Known Exploited Vulnerabilities Catalog. Under operational guidelines tied to federal binding operational directives, the inclusion of this bug mandated immediate action from government IT security teams, setting a firm compliance deadline of September 9 for federal networks to be fully remediated.

Technical Breakdown of Affected Products and Configurations

The vulnerability impacts a wide array of Palo Alto Networks form factors running specific iterations of the PAN-OS operating system. Organizations utilizing PA-Series hardware appliances, VM-Series virtualized firewalls, and CN-Series containerized firewall solutions must verify their software versions against the vendor’s matrix.

PAN-OS versions deemed vulnerable to attack include any release prior to 10.2.2-h2 in the 10.2 branch, versions prior to 10.1.6-h6 in the 10.1 branch, and iterations prior to 10.0.11-h1 in the 10.0 branch. Additionally, older enterprise deployments running legacy software trees are equally at risk, specifically versions prior to 9.1.14-h4, 9.0.16-h3, and 8.1.23-h1.

Palo Alto Networks has maintained throughout the advisory process that the vulnerability cannot be exploited on standard, out-of-the-box configurations. The conditions required for a successful exploit involve a distinct policy misconfiguration that network administrators typically do not implement intentionally. Specifically, the firewall configuration must marry a URL filtering profile containing active block categories with an external-facing source zone. When an external attacker sends crafted traffic matching these criteria, the PAN-OS device improperly handles the transaction, enabling the system to reflect and amplify TCP traffic toward an attacker-designated destination. Because the resulting flood of data appears to originate from the corporate firewall’s external IP address, tracing the true origin of the attack becomes exceptionally difficult for the ultimate victim.

Mechanics of Reflected and Amplified TCP Denial-of-Service Attacks

To understand the gravity of CISA’s warning, security analysts point to the fundamental mechanics of reflected and amplified denial-of-service attacks. Modern distributed denial-of-service operations have evolved far beyond simple volumetric botnets. Today, threat actors prioritize efficiency and amplification, leveraging misconfigured network infrastructure, public DNS resolvers, Network Time Protocol servers, and enterprise security appliances to multiply the destructive output of their operations.

In the case of CVE-2022-0028, attackers execute a sophisticated variation of a TCP reflection attack. The process begins when the adversary transmits a spoofed SYN packet to the vulnerable Palo Alto Networks firewall. Crucially, the source IP address inside the packet header is artificially altered—or spoofed—to display the IP address of the intended victim, rather than the attacker’s actual machine.

Upon receiving the incoming packet, the vulnerable PAN-OS firewall processes the request according to the misconfigured URL filtering policy and responds by sending a SYN-ACK packet directly to the victim’s IP address. If the targeted organization’s infrastructure does not respond to this unexpected handshake attempt, the reflection service built into the firewall will typically initiate automated retransmissions of the SYN-ACK packet, adhering to standard networking protocols.

Through careful manipulation of these retransmission parameters and the orchestration of multiple concurrent requests routed through various compromised firewalls, an attacker can dramatically magnify the volume of malicious traffic pummeling a target. This technique achieves two primary objectives for the adversary: it significantly multiplies the volume of junk traffic generated relative to the attacker’s available bandwidth, and it effectively obfuscates the true source of the assault by hiding behind reputable corporate network infrastructure.

Broader Business Impact and Operational Implications

The discovery and active exploitation of CVE-2022-0028 highlight the critical operational risks associated with enterprise security infrastructure misconfigurations. While perimeter firewalls are designed to protect organizations from external threats, vulnerabilities within these gatekeeping devices can paradoxically transform them into formidable threat vectors.

When a major enterprise firewall is co-opted into a denial-of-service amplification scheme, the consequences extend far beyond internal IT compliance metrics. For the ultimate target of the reflected attack, the incoming flood of TCP traffic can quickly saturate network bandwidth, exhaust server connection tables, and crash critical application infrastructure. For businesses knocked offline by such attacks, the financial and reputational fallout can be severe. E-commerce platforms lose transactional revenue, customer service portals become inaccessible, and brand trust is eroded.

Furthermore, organizations whose firewalls are unwittingly weaponized face secondary risks. Unsuspecting businesses acting as reflectors may experience degraded local firewall performance, unexpected CPU spikes, and potential blacklisting of their external IP addresses by automated threat intelligence feeds and internet service providers. Such blacklisting can inadvertently sever an organization’s legitimate inbound and outbound communications, halting routine business operations.

Remediation Guidance and Industry Best Practices

In response to the active exploitation campaign, cybersecurity authorities and Palo Alto Networks have laid out clear remediation pathways for affected enterprises. System administrators managing PA, VM, or CN-Series firewalls are instructed to immediately review their security policies for the specific non-standard configuration flagged in the security advisory.

Organizations must verify whether any security rules with external-facing source zones utilize URL filtering profiles containing blocked categories. If such configurations are identified, administrators should modify the rules to eliminate the risk condition while concurrently applying the vendor-supplied PAN-OS software patches.

For federal agencies, compliance with CISA’s binding operational directive is mandatory by the September 9 deadline. For the broader commercial sector, cybersecurity leaders emphasize that proactive vulnerability management and continuous configuration auditing remain the most effective defenses against emerging threat vectors. As adversaries continue to scan the digital landscape for zero-day vulnerabilities and deployment oversights, swift patch management is no longer merely a best practice—it is an absolute operational necessity for maintaining enterprise cyber resilience.