9.8
Critical
CVE-2022-40684 Fortinet Multiple Products Authentication Bypass Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Known to be used
Weakness
CWE-288
Description
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiOS, FortiProxy, FortiSwitchManager | Versions not published |