{"id":"CVE-2022-40684","kind":"vulnerability","aliases":["CVE-2022-40684"],"related":[],"title":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through…","description":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","summary":"Fortinet FortiOS, FortiProxy and FortiSwitchManager have an authentication bypass in the administrative interface. An unauthenticated attacker can send crafted HTTP or HTTPS requests to perform administrative operations.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2022-10-11T00:00:00+00:00","products":[{"name":"Fortinet Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.0.7"],"affected":">= 7.0.0, < 7.0.7","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":"= 7.2.0","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":[],"affected":"= 7.0.0","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":[],"affected":"= 7.2.0","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.0.7"],"affected":">= 7.0.0, < 7.0.7","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.2.2"],"affected":">= 7.2.0, < 7.2.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortios","fortiproxy","fortiswitchmanager","infrastructure","ransomware","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor updates per Fortinet's advisory; CISA's KEV entry says only 'apply updates per vendor instructions'. Fixed version numbers: unknown from sources.","status":"open","published_at":"2022-10-11T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:32+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:10:32Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates per Fortinet's advisory; CISA's KEV entry says only 'apply updates per vendor instructions'. Fixed version numbers: unknown from sources.","reach":"internet","impact":"high","summary":"Fortinet FortiOS, FortiProxy and FortiSwitchManager have an authentication bypass in the administrative interface. An unauthenticated attacker can send crafted HTTP or HTTPS requests to perform administrative operations.","category":"infrastructure","who_cares":["fortios","fortiproxy","fortiswitchmanager","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker performs administrative actions on the device's admin interface.","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2022-40684 to get affected and fixed versions, the admin-interface exposure check, and any IOCs; sources given here do not name versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000487,"input_tokens":2839,"output_tokens":407,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':18A,21A '-288':11A,84C '-40684':19A,22A '7.0.0':93C,101C,109C '7.0.6':95C,103C '7.2.0':16A,89C,98C,107C '7.2.1':91C 'administr':58B,72B,119C 'allow':110C 'altern':6A,79C 'attack':62B 'atttack':113C 'authent':2A,54B,75C 'bypass':3A,55B,76C 'channel':9A,82C 'craft':65B,123C 'cve':17A,20A 'cwe':10A,83C 'exploit':38B 'fortinet':13A,23A,26A,28A,30A,32A,34A,36A,47B,86C 'fortio':14A,39B,48B,87C 'fortios':35A,37A 'fortiproxi':40B,49B,96C 'fortiproxy':27A,29A 'fortiswitchmanag':41B,51B,105C 'fortiswitchmanager':31A,33A 'host':46B 'http':66B,124C 'https':68B,126C 'infrastructur':42B 'interfac':59B,120C 'multiple':24A 'oper':73B,116C 'path':7A,80C 'perform':71B,115C 'products':25A 'ransomwar':43B 'request':69B,127C 'self':45B 'self-host':44B 'send':64B 'special':122C 'unauthent':61B,112C 'use':4A,77C 'version':15A,88C,97C,100C,106C 'via':121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-10-11T00:00:00+00:00","kev":{"dateAdded":"2022-10-11","dueDate":"2022-11-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-40684","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-40684","severity":null,"published_at":"2022-10-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-40684","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40684","severity":null,"published_at":"2022-10-18T14:15:09+00:00","modified_at":"2026-08-06T05:16:37+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}