Servers and applications

CVE-2022-42475

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 13 Dec 2022.

Severity: Critical 9.8
Published: 2 Jan 2023
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 6.4.10, 6.4.11, 7.0.8, 7.0.9, 7.2.2, 7.2.3
Sources: NVD

Affected software

Software Affected versions

Software	Affected versions
Fortinet FortiProxyServers and applications · `cpe:a:fortinet:fortiproxy`	From 1.0.0 up to 1.0.7 From 1.1.0 up to 1.1.6 From 1.2.0 up to 1.2.13 From 2.0.0 before 2.0.12 From 7.0.0 before 7.0.8 From 7.2.0 before 7.2.2
Fortinet FortiOSServers and applications · `cpe:o:fortinet:fortios`	From 7.2.0 before 7.2.3 From 7.0.0 before 7.0.8 From 7.0.0 before 7.0.9 From 6.4.0 before 6.4.10 All 12 release lines From 5.0.0 up to 5.0.14 From 5.2.0 up to 5.2.15 From 5.4.0 up to 5.4.13 From 5.6.0 up to 5.6.14 From 6.0.0 before 6.0.16 From 6.0.0 before 6.0.15 From 6.2.0 before 6.2.12 From 6.4.0 before 6.4.11 From 6.4.0 before 6.4.10 From 7.0.0 before 7.0.9 From 7.0.0 before 7.0.8 From 7.2.0 before 7.2.3

Fortinet FortiProxyServers and applications · cpe:a:fortinet:fortiproxy

From 1.0.0 up to 1.0.7
From 1.1.0 up to 1.1.6
From 1.2.0 up to 1.2.13
From 2.0.0 before 2.0.12
From 7.0.0 before 7.0.8
From 7.2.0 before 7.2.2

Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios

From 7.2.0 before 7.2.3
From 7.0.0 before 7.0.8
From 7.0.0 before 7.0.9
From 6.4.0 before 6.4.10

All 12 release lines

From 5.0.0 up to 5.0.14
From 5.2.0 up to 5.2.15
From 5.4.0 up to 5.4.13
From 5.6.0 up to 5.6.14
From 6.0.0 before 6.0.16
From 6.0.0 before 6.0.15
From 6.2.0 before 6.2.12
From 6.4.0 before 6.4.11
From 6.4.0 before 6.4.10
From 7.0.0 before 7.0.9
From 7.0.0 before 7.0.8
From 7.2.0 before 7.2.3

Known exploited

CISA name: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Required action: Apply updates per vendor instructions.
Due for US agencies: 3 Jan 2023
Used in ransomware: Yes, known

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2022-42475
CVE.org https://www.cve.org/CVERecord?id=CVE-2022-42475