CVE-2022-40684
CISA KEV RANSOMWARE
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CISA Known Exploited Vulnerability
Vendor / Product
Fortinet — Multiple Products
Date Added
2022-10-11
Remediation Due
2022-11-01
Ransomware Use
CONFIRMED
https://www.fortiguard.com/psirt/FG-IR-22-377; https://nvd.nist.gov/vuln/detail/CVE-2022-40684
Weakness Classification (1)
Affected Software (6)
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortios | 7.0.0 – 7.0.7 |
| fortinet | fortios | 7.2.0 – 7.2.2 |
| fortinet | fortiproxy | 7.0.0 – 7.0.7 |
| fortinet | fortiproxy | 7.2.0 |
| fortinet | fortiswitchmanager | 7.0.0 |
| fortinet | fortiswitchmanager | 7.2.0 |
References & Advisories (4)
US Government Resource
Mitigation
Vendor Advisory
Exploit
Third Party Advisory
VDB Entry
Exploit
Third Party Advisory
VDB Entry