Live › vulnerability › CVE-2022-40684
Go to dashboardFortinet FortiOS, FortiProxy and FortiSwitchManager have an authentication bypass in the administrative interface. An unauthenticated attacker can send crafted HTTP or HTTPS requests to perform administrative operations.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fortinet Multiple Products | vendor | – | – |
| fortinet fortiproxy | vendor | >= 7.0.0, < 7.0.7 | 7.0.7 |
| fortinet fortiproxy | vendor | = 7.2.0 | – |
| fortinet fortiswitchmanager | vendor | = 7.0.0 | – |
| fortinet fortiswitchmanager | vendor | = 7.2.0 | – |
| fortinet fortios | vendor | >= 7.0.0, < 7.0.7 | 7.0.7 |
| fortinet fortios | vendor | >= 7.2.0, < 7.2.2 | 7.2.2 |
Unknown from the sources.
s advisory; CISAs KEV entry says only apply updates per vendor instructionsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
This page as .md · .json · in your agent: get_signal("CVE-2022-40684")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.