The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical unauthenticated Palo Alto Networks’ PAN-OS firewall bug to its catalog of Known Exploitable Vulnerabilities. This flaw was identified by a service provider and was exploited in an attempt to conduct a reflected amplification distributed denial-of-service (DDoS) attack. Reflected amplification is one of the more popular DDoS attack types utilized by threat actors today and combines two (2) attack methods (reflection and amplification) which enable the threat actors to obscure their hijacked attack sources while exponentially magnifying the amount of malicious data packets they can generate and leverage against their targets. The vulnerability, tracked as CVE-2022-0028, stems from a PAN-OS URL filtering policy misconfiguration, and the DDoS traffic appeared to be originating from Palo Alto Networks’ PA-Series, VM-Series, and CN-Series firewalls. For the threat actors to be able to exploit this vulnerability, the firewalls must be configured to have a URL filter profile with blocked categories that are assigned to sources with a public-facing network interface. Although this attack is limited to DoS, it is dangerous because the attackers obfuscate their identities and the affected devices may have no clear sign of being compromised, making the attack difficult to prevent. That, coupled with the low complexity of the attack, means that the threat actors don’t have to use massive botnets or hijack multiple servers and gives this vulnerability a CVSS score of 8.6/10. This flaw has been patched by Palo Alto Networks and CTIX analysts urge any customers to update their PAN-OS firewalls to the latest secure versions. If the patch cannot immediately be implemented, Palo Alto Networks has provided users with manual mitigation techniques which are detailed in the advisory linked below. Although effective against DoS attacks, mitigations like rate limiting, port blocking, and filtering traffic signatures may have negative effects on overall bandwidth and performance. As a best practice, the CTIX team recommends that threat intelligence services be leveraged to better enable security professionals in identifying vulnerable endpoints and proactively blocking malicious IP addresses.