CVE-2022-40684criticalunder attackransomwareCWE-287

CVE-2022-40684: critical vulnerability in Fortinet FortiOS, FortiProxy, FortiSwitchManager

Published · Updated

Follow this CVE+ Monitor FortiOS+ Monitor FortiProxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDOct 18
1st PoCOct 13
metasploitOct 10
CISA KEVOct 11
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

RansomwareAkira ransomware.live
Action required by CISAfederal deadline: 2022-11-01

Apply updates per vendor instructions.

In short

FortiOS, FortiProxy, and FortiSwitchManager contain a flaw that allows attackers to bypass login requirements and access the admin panel without credentials by sending specially crafted requests. This is critical because admin access can lead to full system compromise.

Technical detail

An authentication bypass vulnerability in Fortinet products (FortiOS 7.0.0–7.0.6, 7.2.0–7.2.1; FortiProxy 7.0.0–7.0.6, 7.2.0; FortiSwitchManager 7.0.0, 7.2.0) allows unauthenticated remote attackers to access the administrative interface via malformed HTTP/HTTPS requests, exploiting CWE-287 (improper authentication). No credentials or pre-authentication are required; successful exploitation grants full administrative privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
Affected products
Fortinet · Fortinet FortiOS, FortiProxy, FortiSwitchManager
public PoCs found — 62
exploitdbwww.exploit-db.com/exploits/51092unverifiedexploitdbwww.exploit-db.com/exploits/52239unverifiedgithubgithub.com/horizon3ai/CVE-2022-40684★ 358githubgithub.com/carlosevieira/CVE-2022-40684★ 87githubgithub.com/arsolutioner/fortigate-belsen-leak★ 87githubgithub.com/kljunowsky/CVE-2022-40684-POC★ 16githubgithub.com/Filiplain/Fortinet-PoC-Auth-Bypass★ 16githubgithub.com/TaroballzChen/CVE-2022-40684-metasploit-scanner★ 14githubgithub.com/hughink/CVE-2022-40684★ 11githubgithub.com/qingsiweisan/CVE-2022-40684★ 9githubgithub.com/Chocapikk/CVE-2022-40684★ 7githubgithub.com/secunnix/CVE-2022-40684★ 5githubgithub.com/z-bool/CVE-2022-40684★ 5githubgithub.com/und3sc0n0c1d0/CVE-2022-40684★ 4githubgithub.com/xtwip/fortipwn★ 4githubgithub.com/gustavorobertux/gotigate★ 2githubgithub.com/jsongmax/Fortinet-CVE-2022-40684★ 2githubgithub.com/HAWA771/CVE-2022-40684★ 2githubgithub.com/Vampsecure-Labs/vamp-forticheck★ 2githubgithub.com/NeriaBasha/CVE-2022-40684★ 1githubgithub.com/iveresk/CVE-2022-40684★ 1githubgithub.com/XalfiE/Fortigate-Belsen-Leak-Dump-CVE-2022-40684-★ 1githubgithub.com/ccordeiro/CVE-2022-40684★ 0githubgithub.com/ClickCyber/cve-2022-40684★ 0githubgithub.com/puckiestyle/CVE-2022-40684★ 0githubgithub.com/notareaperbutDR34P3r/CVE-2022-40684-Rust★ 0githubgithub.com/dkstar11q/CVE-2022-40684★ 0githubgithub.com/Anthony1500/CVE-2022-40684★ 0githubgithub.com/niklasmato/fortileak-01-2025-Be★ 0githubgithub.com/Yami0x777/Belsen_Group-et-exploitation-de-la-CVE-2022-40684★ 0githubgithub.com/pintukumar-sutradhar/fortigate-cve-2022-40684-tool★ 0githubgithub.com/gotr00t0day/CVE-2022-40684★ 0githubgithub.com/mhd108/CVE-2022-40684★ 0githubgithub.com/belky-me/vamp-forticheck★ 0vulncheckvulncheck.com/xdb/6a6f9b30827funverifiedvulncheckvulncheck.com/xdb/a29d24addb6dunverifiedvulncheckvulncheck.com/xdb/e7be9b40e314unverifiedvulncheckvulncheck.com/xdb/0037fa291764unverifiedvulncheckvulncheck.com/xdb/ae0c71764619unverifiedvulncheckvulncheck.com/xdb/dc9f6a9f6c27unverifiedvulncheckvulncheck.com/xdb/b6787ce31611unverifiedvulncheckvulncheck.com/xdb/2e43eee43157unverifiedvulncheckvulncheck.com/xdb/9f2799649c05unverifiedvulncheckvulncheck.com/xdb/b30548fd63d6unverifiedvulncheckvulncheck.com/xdb/687ac29ec096unverifiedvulncheckvulncheck.com/xdb/76441680e6b1unverifiedvulncheckvulncheck.com/xdb/b1bf53fd758dunverifiedvulncheckvulncheck.com/xdb/db8ccd288f72unverifiedvulncheckvulncheck.com/xdb/0f732bdee343unverifiedvulncheckvulncheck.com/xdb/a36497ad5dd2unverifiedvulncheckvulncheck.com/xdb/2e60dd7133e1unverifiedvulncheckvulncheck.com/xdb/38b52c3e8812unverifiedvulncheckvulncheck.com/xdb/e3e297f34311unverifiedvulncheckvulncheck.com/xdb/006745572ba2unverifiedcve_referencepacketstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.htmlunverifiedvulncheckvulncheck.com/xdb/7ee0908e7341unverifiedvulncheckvulncheck.com/xdb/b079d1d5156dunverifiedvulncheckvulncheck.com/xdb/37fe630b4cc1unverifiedvulncheckvulncheck.com/xdb/572e1ae2ee5aunverifiedcve_referencepacketstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.htmlunverifiedvulncheckvulncheck.com/xdb/1315787605ecunverifiedvulncheckvulncheck.com/xdb/94e9ab177128unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.