CVE-2022-0011

Description

PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website .test example.com .* will match example.com.website .test example.com .^ will match example.com .test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2022-0011 on 2026-07-27. Shown when MITRE's text differs from the cvelistV5 mirror.

PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL.

Overview

State

—

Assigner (CNA)

—

CVSS severity

MEDIUM

CVSS score

5.0 / 10

CVSS vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Effective score

5.0 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

2022-02-09 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/palo-alto-networks-pan-os-cve-2022-0011/

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2022-02-10 18:15:08 UTC

NVD last modified

2026-06-17 04:19:52 UTC

NVD CVSS v3.1

6.5 / 10 MEDIUM source: psirt@paloaltonetworks.com

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability subscore

2.8 / 10

Impact subscore

3.6 / 10

EPSS score

0.0066 (probability of exploitation in next 30 days)

EPSS percentile

47.93% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-436 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2022-15232

Assigner

palo_alto

Published

Feb 10, 2022, 6:10:15 PM

Updated

Sep 16, 2024, 11:51:26 PM

EUVD base score (CVSS 3.1)

6.5 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EUVD-reported EPSS

0.6600

Vendors

Palo Alto Networks

Products

Prisma Access (2.2 Preferred)

Prisma Access (2.1 Preferred, Innovation)

PAN-OS (9.0.*)

PAN-OS (10.1 <10.1.3)

PAN-OS (9.1 <9.1.12)

PAN-OS (10.0 <10.0.8)

PAN-OS (8.1 <8.1.21)

Aliases

GHSA-pc4w-x9p8-64j7

ENISA description: PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (7)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• http://cwe.mitre.org/data/definitions/436.html rapid7:cwe.mitre.org
• http://example.com rapid7:example.com
• http://example.com.website rapid7:example.com.website
• https://attackerkb.com/topics/CVE-2022-0011 rapid7:attackerkb.com
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15232 rapid7:euvd.enisa.europa.eu
• https://security.paloaltonetworks.com/CVE-2022-0011 rapid7:security.paloaltonetworks.com
• https://www.cve.org/CVERecord?id=CVE-2022-0011 rapid7:www.cve.org

• Releases: tips2fix/Tips2Fix-Windows11-Installer - GitHub
  web:github.com

  Cleaner UI, smarter CPU detection, and fully user-friendly — the safest Tips2Fix installer yet. 🛡️ Antivirus Note Some antivirus programs may flag this tool as a virus or trojan, but that's a false positive ⚠️. Why? Because the installer is a PowerShell script inside a .bat wrapper, and antiviruses sometimes flag scripts that interact with setup files. Tips2Fix-Windows11-Installer ...

  2026-06-04 05:09 UTC
• Windows 11, version 24H2 update history - Microsoft Support
  web:support.microsoft.com

  Updates for Windows 11, version 24H2 Windows 11 is a service, which means it gets better through periodic feature updates. We take a phased and measured approach to rolling out every feature update. That means you'll receive Windows 11, version 24H2 when data shows that your device is ready and that you will have a great update experience. On the left side of this page, you'll find a list ...

  2026-06-04 05:09 UTC
• Microsoft releases Windows 11 OOB hotpatch to fix RRAS RCE flaw
  web:www.bleepingcomputer.com

  Microsoft has released an out-of-band (OOB) update to fix a security vulnerabilities affecting Windows 11 Enterprise devices that receive hotpatch updates instead of the regular Patch Tuesday ...

  2026-06-04 05:09 UTC
• February's Patch Tuesday release fixes 59 flaws ... - Computerworld
  web:www.computerworld.com

  Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

  2026-06-04 05:09 UTC
• Microsoft October / November 2025 Security Updates - Windows 11 Forum
  web:www.elevenforum.com

  October 2025 Security Updates This release consists of the following 175 Microsoft CVEs : Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations ? Agere Windows Modem Driver CVE -2025-24052 Agere Windows Modem Driver CVE -2025-24990 Microsoft PowerShell CVE -2025-25004 Windows...

  2026-06-04 05:09 UTC
• Windows 11 (KB5066835, KB5066793) October 2025 Patch Tuesday out
  web:www.neowin.net

  Microsoft has released Patch Tuesday updates for Windows 11 (KB5066835, KB5066793) for August 2025. Here's what's included.

  2026-06-04 05:09 UTC
• Microsoft KB Catalog: Updates, Issues, & Feedback - NinjaOne
  web:www.ninjaone.com

  Catalog of Microsoft KB updates with insights on performance & user sentiment. Find out what's working, what's not, & make informed decisions.

  2026-06-04 05:09 UTC
• MiniPlasma zero-day gives SYSTEM access on fully patched Windows 11
  web:www.notebookcheck.net

  A working proof-of-concept for MiniPlasma, a Windows Cloud Filter driver zero-day, lets standard users gain SYSTEM privileges on fully patched Windows 11 systems.

  2026-06-04 05:09 UTC
• Windows 11's Secure Boot fix update finally rolls out to ... - PCWorld
  web:www.pcworld.com

  Windows 11's Secure Boot fix update finally rolls out to more PCs Important security certificates for Windows 11 will soon expire for many users.

  2026-06-04 05:09 UTC
• Microsoft's urgent Window 11 patch fixes 30 'critical' bugs — update ...
  web:www.tomsguide.com

  Microsoft's big May 2026 Patch Tuesday fixes more than 138 vulnerabilities overall.

  2026-06-04 05:09 UTC

Only Available for Registered Users. Sign in to view.