CVE-2022-39952: Fortinet FortiNAC unauthenticated path control leads to code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction and an EPSS near 1.0 make this a top-priority remote code execution risk for exposed FortiNAC appliances.

What it is

FortiNAC versions across the 8.x, 9.1, 9.2 and 9.4 lines mishandle externally controlled file names or paths, allowing an unauthenticated attacker to execute unauthorized code or commands through a crafted HTTP request. The flaw is remotely reachable with no privileges or user interaction, and the vendor advisory is the only reference supplied.

Impact

An attacker can run arbitrary code or commands on the FortiNAC appliance, gaining full control of the host with high confidentiality, integrity and availability impact. Because FortiNAC is a network access control system, compromise can also undermine the network enforcement it provides.

Attack surface

Reached over the network via a specifically crafted HTTP request to the FortiNAC web interface; the CVSS vector shows no authentication (PR:N) and no user interaction (UI:N) required.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at roughly 0.998 (99.96th percentile), indicating strong likelihood of exploitation activity. The only references are vendor advisories, so no public exploit details are confirmed in this record.

What to do

• Upgrade FortiNAC to a fixed release per Fortinet advisory FG-IR-22-300; the record does not list the fixed versions, so confirm them with the vendor.
• Restrict network access to the FortiNAC management and web interfaces to trusted administrative networks only.
• Place FortiNAC behind a reverse proxy or WAF with rules blocking path traversal and unusual file-name parameters.
• Monitor Fortinet PSIRT and CISA advisories for updated exploitation guidance and any KEV addition.
• If patching cannot be done immediately, isolate the appliance and audit it for signs of compromise.

Detection

• Review HTTP access and error logs on FortiNAC for requests containing path traversal sequences or unusual file-name parameters.
• Hunt for unexpected child processes, web shells, or new files in web-accessible directories on the FortiNAC host.
• Alert on outbound connections from FortiNAC to unfamiliar external hosts, which may indicate post-exploitation activity.
• Correlate FortiNAC authentication and configuration logs for changes made outside normal administrative windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.