$ cve CVE-2022-40684 JSON

CVE-2022-40684 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-11-01.

Description

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.98% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-287
On CISA KEV	yes — remediate by 2022-11-01
Public exploit	yes
Published	2022-10-18
Last modified	2026-08-06

CISA KEV

Name	Fortinet Multiple Products Authentication Bypass Vulnerability
Added	2022-10-11
Due	2022-11-01
Vendor / product	Fortinet / Multiple Products
Ransomware use	known

Affected (3)

Vendor	Product
fortinet	fortios
fortinet	fortiproxy
fortinet	fortiswitchmanager

Public exploits

Source	Title	Date
exploit-db	Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass	2025-04-16
exploit-db	FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass	2023-03-27

References

→ the Explorer · watch your stack · NVD