Fortinet · Multiple Products
CVE-2022-40684
Fortinet Multiple Products Authentication Bypass Vulnerability
What it is
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CISA: Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 1, 2022
More exploited flaws from Fortinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 16, 2026 | Path Traversal | Multiple Products | Medium 5.4 | 1.3% |
| Sep 9, 2026 | Heap-based Buffer Overflow | Multiple Products | High 7.4 | 3.7% |
| Jan 27, 2026 | Authentication Bypass Using an Alternate Path or Channel | Multiple Products | Critical 9.4 | 87% |
| Dec 16, 2025 | Improper Verification of Cryptographic Signature | Multiple Products | Critical 9.1 | 68% |
| May 14, 2025 | Stack-Based Buffer Overflow | Multiple Products | Critical 9.6 | 31% |
| Oct 9, 2024 | Format String | Multiple Products | Critical 9.8 | 62% |
| Oct 1, 2026 | Path Traversal | FortiMail | Critical 9.8 | 4.6% |
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Medium 5.3 | 29% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.