CVE-2022-40684

Fortinet FortiOS, FortiProxy, FortiSwitchManager

Published 18 Oct 2022 · updated 6 Aug 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 11 Oct 2022, with a remediation deadline of 1 Nov 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

References

packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html · Exploit, Third Party Advisory, VDB Entry
fortiguard.com/psirt/FG-IR-22-377 · Mitigation, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684 · US Government Resource