---
id: "CVE-2022-40684"
kind: "vulnerability"
aliases: ["CVE-2022-40684"]
title: "An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Fortinet Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["7.0.7"], "affected": ">= 7.0.0, < 7.0.7", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": "= 7.2.0", "ecosystem": "vendor"}, {"name": "fortinet fortiswitchmanager", "fixed": [], "affected": "= 7.0.0", "ecosystem": "vendor"}, {"name": "fortinet fortiswitchmanager", "fixed": [], "affected": "= 7.2.0", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.0.7"], "affected": ">= 7.0.0, < 7.0.7", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.2.2"], "affected": ">= 7.2.0, < 7.2.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortios", "fortiproxy", "fortiswitchmanager", "infrastructure", "ransomware", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2022-10-11T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-40684", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40684", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through…

Fortinet FortiOS, FortiProxy and FortiSwitchManager have an authentication bypass in the administrative interface. An unauthenticated attacker can send crafted HTTP or HTTPS requests to perform administrative operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fortinet Multiple Products affected ? fixed ?
- vendor:fortinet fortiproxy affected >= 7.0.0, < 7.0.7 fixed 7.0.7
- vendor:fortinet fortiproxy affected = 7.2.0 fixed ?
- vendor:fortinet fortiswitchmanager affected = 7.0.0 fixed ?
- vendor:fortinet fortiswitchmanager affected = 7.2.0 fixed ?
- vendor:fortinet fortios affected >= 7.0.0, < 7.0.7 fixed 7.0.7
- vendor:fortinet fortios affected >= 7.2.0, < 7.2.2 fixed 7.2.2

## Fix

Apply the vendor updates per Fortinet's advisory; CISA's KEV entry says only 'apply updates per vendor instructions'. Fixed version numbers: unknown from sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-40684
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-40684

## From the sources

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_