CVE DATABASE / CVE-2022-40684
CVE-2022-40684
Fortinet Multiple Products Authentication Bypass Vulnerability
Confirmed exploited in the wild. Added 2022-10-11.
Federal remediation due 2022-11-01.
Required action: Apply updates per vendor instructions.
Summary
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CVSS 3.1 breakdown
| Base score | 9.8 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity | HIGH |
| Availability | HIGH |
Weakness type (CWE)
Affected products
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html
- http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html
- https://fortiguard.com/psirt/FG-IR-22-377
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684
Data: NIST NVD + CISA KEV. NVD last modified 2026-01-14. Always verify against the vendor advisory before acting.