{"schemaVersion":3,"id":"CVE-2022-40684","aliases":[],"status":"published","duplicateOf":null,"title":"Fortinet Multiple Products Authentication Bypass Vulnerability","description":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","dates":{"published":"2022-10-18T00:00:00.000Z","modified":"2026-08-06T03:55:36.678Z","reserved":null,"kevAdded":["2022-10-11T00:00:00.000Z"],"kevDue":["2022-11-01T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99984,"percentile":0.99983,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.99984},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99984,"percentile":0.99983}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99984,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99984,"percentile":0.99983}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-10-11T00:00:00.000Z","dueDate":"2022-11-01T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Fortinet Multiple Products Authentication Bypass Vulnerability","description":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","notes":[{"type":"url","href":"https://www.fortiguard.com/psirt/FG-IR-22-377","label":"www.fortiguard.com/psirt/FG-IR-22-377"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-40684","label":"nvd.nist.gov/vuln/detail/CVE-2022-40684"}],"vendor":"Fortinet","product":"Multiple Products","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-10-11T00:00:00.000Z","dueDate":"2022-11-01T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Fortinet Multiple Products Authentication Bypass Vulnerability","description":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","notes":[{"type":"url","href":"https://www.fortiguard.com/psirt/FG-IR-22-377","label":"www.fortiguard.com/psirt/FG-IR-22-377"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-40684","label":"nvd.nist.gov/vuln/detail/CVE-2022-40684"}],"vendor":"Fortinet","product":"Multiple Products","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"REF_F6B9911EEB32E427","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_7E19C46482EA168E","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"51092","name":"FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass","source":"exploit-database","url":"https://www.exploit-db.com/exploits/51092","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"multiple","file":"exploits/multiple/webapps/51092.sh","codes":["CVE-2022-40684"]},"metasploit":null},{"id":"52239","name":"Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass","source":"exploit-database","url":"https://www.exploit-db.com/exploits/52239","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"windows","file":"exploits/windows/remote/52239.py","codes":["CVE-2022-40684"]},"metasploit":null},{"id":"MSF_EXPLOIT_LINUX_HTTP_FORTINET_AUTHENTICATION_BYPASS_CVE_2022_40684","name":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager authentication bypass.","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs","artifacts-on-disk"],"reliability":["repeatable-session"]}}],"exploitCount":5,"weaknesses":[{"id":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/287.html"}],"affected":[{"vendor":"fortinet","product":"fortinet fortios, fortiproxy, fortiswitchmanager","name":"Fortinet FortiOS, FortiProxy, FortiSwitchManager","label":"fortinet fortios, fortiproxy, fortiswitchmanager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0","eol":null,"hubHref":"/vendor/fortinet/fortinet_fortios_fortiproxy_fortiswitchmanager"},{"vendor":"fortinet","product":"fortios","name":"fortios","label":"fortios","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, < 7.0.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, < 7.2.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, < 7.0.7 | ≥ 7.2.0, < 7.2.2","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"fortios","label":"FortiOS","category":"os"}},"hubHref":"/vendor/fortinet/fortios"},{"vendor":"fortinet","product":"fortiproxy","name":"fortiproxy","label":"fortiproxy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, < 7.0.7","noFixRecorded":false,"fixedIn":null},{"text":"7.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, < 7.0.7 | 7.2.0","eol":null,"hubHref":"/vendor/fortinet/fortiproxy"},{"vendor":"fortinet","product":"fortiswitchmanager","name":"fortiswitchmanager","label":"fortiswitchmanager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.0.0","noFixRecorded":false,"fixedIn":null},{"text":"7.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0.0 | 7.2.0","eol":null,"hubHref":"/vendor/fortinet/fortiswitchmanager"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-377","label":"fortiguard.com/psirt/FG-IR-22-377","hostname":"fortiguard.com","tags":["Mitigation","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html","label":"packetstormsecurity.com/files/…","hostname":"packetstormsecurity.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html","label":"packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html","hostname":"packetstormsecurity.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"kev-added","date":"2022-10-11T00:00:00.000Z","label":"Added to CISA KEV","detail":"Fortinet Multiple Products Authentication Bypass Vulnerability","source":"cisa"},{"kind":"published","date":"2022-10-18T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-due","date":"2022-11-01T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-08-06T03:55:36.678Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T15:15:26.543Z","stale":false,"partial":false}}