---
id: "CVE-2022-42475"
kind: "vulnerability"
aliases: ["CVE-2022-42475"]
title: "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8,\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "fortinet fortios", "fixed": [], "affected": ">= 5.0.0, <= 5.0.14", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 5.2.0, <= 5.2.15", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 5.4.0, <= 5.4.13", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 5.6.0, <= 5.6.14", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["6.0.16"], "affected": ">= 6.0.0, < 6.0.16", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["6.2.12"], "affected": ">= 6.2.0, < 6.2.12", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["6.4.11"], "affected": ">= 6.4.0, < 6.4.11", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.0.9"], "affected": ">= 7.0.0, < 7.0.9", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.2.3"], "affected": ">= 7.2.0, < 7.2.3", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 1.0.0, <= 1.0.7", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 1.1.0, <= 1.1.6", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 1.2.0, <= 1.2.13", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["2.0.12"], "affected": ">= 2.0.0, < 2.0.12", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["7.0.8"], "affected": ">= 7.0.0, < 7.0.8", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["7.2.2"], "affected": ">= 7.2.0, < 7.2.2", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["6.0.15"], "affected": ">= 6.0.0, < 6.0.15", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["6.4.10"], "affected": ">= 6.4.0, < 6.4.10", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.0.8"], "affected": ">= 7.0.0, < 7.0.8", "ecosystem": "vendor"}, {"name": "Fortinet FortiOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortigate", "fortios", "infrastructure", "network-appliance", "ransomware", "ssl-vpn"]
not_affected_if: ["non-fortios-devices", "ssl-vpn-disabled"]
published_at: "2022-12-13T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42475", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42475", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8,…

Fortinet FortiOS SSL-VPN has a heap-based buffer overflow that lets an unauthenticated remote attacker run arbitrary code or commands on the appliance via crafted requests. CISA lists it as actively exploited in the wild and tied to ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fortinet fortios affected >= 5.0.0, <= 5.0.14 fixed ?
- vendor:fortinet fortios affected >= 5.2.0, <= 5.2.15 fixed ?
- vendor:fortinet fortios affected >= 5.4.0, <= 5.4.13 fixed ?
- vendor:fortinet fortios affected >= 5.6.0, <= 5.6.14 fixed ?
- vendor:fortinet fortios affected >= 6.0.0, < 6.0.16 fixed 6.0.16
- vendor:fortinet fortios affected >= 6.2.0, < 6.2.12 fixed 6.2.12
- vendor:fortinet fortios affected >= 6.4.0, < 6.4.11 fixed 6.4.11
- vendor:fortinet fortios affected >= 7.0.0, < 7.0.9 fixed 7.0.9
- vendor:fortinet fortios affected >= 7.2.0, < 7.2.3 fixed 7.2.3
- vendor:fortinet fortiproxy affected >= 1.0.0, <= 1.0.7 fixed ?
- vendor:fortinet fortiproxy affected >= 1.1.0, <= 1.1.6 fixed ?
- vendor:fortinet fortiproxy affected >= 1.2.0, <= 1.2.13 fixed ?
- vendor:fortinet fortiproxy affected >= 2.0.0, < 2.0.12 fixed 2.0.12
- vendor:fortinet fortiproxy affected >= 7.0.0, < 7.0.8 fixed 7.0.8
- vendor:fortinet fortiproxy affected >= 7.2.0, < 7.2.2 fixed 7.2.2
- vendor:fortinet fortios affected >= 6.0.0, < 6.0.15 fixed 6.0.15
- vendor:fortinet fortios affected >= 6.4.0, < 6.4.10 fixed 6.4.10
- vendor:fortinet fortios affected >= 7.0.0, < 7.0.8 fixed 7.0.8
- vendor:Fortinet FortiOS affected ? fixed ?

## How to check

Check whether the SSL-VPN feature is enabled on the FortiGate and which FortiOS version is running (the sources do not give exact affected version ranges).

## Fix

Apply the FortiOS update per Fortinet's vendor advisory (the sources do not name the fixed version).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42475
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-42475

## From the sources

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_