UpHeron
All vulnerabilities

Servers and applications

CVE-2022-40684

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 11 Oct 2022.

Severity
Critical 9.8
Published
18 Oct 2022
Last changed
6 Aug 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.0.7, 7.2.2
Sources
NVD

Affected software

SoftwareAffected versions
Fortinet FortiProxyServers and applications · cpe:a:fortinet:fortiproxy
  • From 7.0.0 before 7.0.7
  • Version 7.2.0
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios
  • From 7.0.0 before 7.0.7
  • From 7.2.0 before 7.2.2

Known exploited

CISA name
Fortinet Multiple Products Authentication Bypass Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
1 Nov 2022
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-40684
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-40684