CVE-2022-0022

Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7.

• CWE-916
• CWE-916

• https://security.paloaltonetworks.com/CVE-2022-0022Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2022-0022Vendor Advisory

Published

Mar 9, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0016An improper handling of exceptional conditions vulnerability…7.8
• CVE-2022-0017An improper link resolution before file access ('link follow…7.8
• CVE-2022-0018An information exposure vulnerability exists in the Palo Alt…6.5
• CVE-2022-0019An insufficiently protected credentials vulnerability exists…5.5
• CVE-2022-0020A stored cross-site scripting (XSS) vulnerability in Palo Al…5.4
• CVE-2022-0021An information exposure through log file vulnerability exist…5.5
• CVE-2022-0023An improper handling of exceptional conditions vulnerability…5.9
• CVE-2022-0024A vulnerability exists in Palo Alto Networks PAN-OS software…7.2
• CVE-2022-0025A local privilege escalation (PE) vulnerability exists in Pa…6.7
• CVE-2022-0026A local privilege escalation (PE) vulnerability exists in Pa…6.7
• CVE-2022-0027An improper authorization vulnerability in Palo Alto Network…4.3
• CVE-2022-0028A PAN-OS URL filtering policy misconfiguration could allow a…8.6