CVEvulnerability

CVE-2022-40684

9.8 CRITICAL Known exploited Published 2022-10-18 Modified 2026-08-06 Official page ↗

CISA Known Exploited Vulnerability

Fortinet Multiple Products Authentication Bypass Vulnerability — Fortinet Multiple Products

Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Added to KEV: 2022-10-11
Remediation due: 2022-11-01
Ransomware use: Known
Required action: Apply updates per vendor instructions.
Notes: https://www.fortiguard.com/psirt/FG-IR-22-377; https://nvd.nist.gov/vuln/detail/CVE-2022-40684

Status: Analyzed
Published: 2022-10-18
Last modified: 2026-08-06
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-287

Description

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Affected configurations

• fortinet fortiproxy (>= 7.0.0 < 7.0.7) • fortinet fortiproxy 7.2.0 • fortinet fortiswitchmanager 7.0.0 • fortinet fortiswitchmanager 7.2.0 • fortinet fortios (>= 7.0.0 < 7.0.7) • fortinet fortios (>= 7.2.0 < 7.2.2)

Weakness · CWE (1)

CWE-287 Improper Authentication weakness

References