CVE-2022-40684: Fortinet FortiOS, FortiProxy and FortiSwitchManager admin interface auth bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, active KEV listing with known ransomware use, and near-maximum EPSS probability make this an urgent patch.

What it is

An authentication bypass (CWE-288, alternate path or channel) in Fortinet FortiOS 7.2.0-7.2.1 and 7.0.0-7.0.6, FortiProxy 7.2.0 and 7.0.0-7.0.6, and FortiSwitchManager 7.2.0 and 7.0.0 lets an unauthenticated attacker act on the administrative interface via crafted HTTP or HTTPS requests. It matters because the management plane is reachable without credentials and the flaw is already in CISA KEV with known ransomware campaign use.

Impact

An attacker gains the ability to perform administrative operations on the affected device without authenticating, which can lead to full compromise of the appliance and the network it protects.

Attack surface

Reached over the network via specially crafted HTTP or HTTPS requests to the administrative interface; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Listed in CISA KEV (added 2022-10-11, due 2022-11-01) with known ransomware campaign use, and EPSS 30-day probability is 0.99984 (percentile 0.99983); multiple references are tagged Exploit.

What to do

• Apply the Fortinet updates referenced in FG-IR-22-377 for FortiOS, FortiProxy and FortiSwitchManager; patch first.
• Until patched, restrict administrative interface access to trusted management networks and disable internet-facing admin access.
• Follow the vendor mitigation guidance in FG-IR-22-377 for any interim workarounds.
• Rotate credentials and review device configuration for unauthorized changes on any potentially exposed appliance.

Detection

• Review HTTP/HTTPS request logs to the administrative interface for anomalous or malformed requests consistent with the published exploit.
• Audit administrative actions and configuration changes for activity not tied to a legitimate authenticated session.
• Monitor for unexpected creation or modification of admin accounts, API tokens or system settings on Fortinet devices.
• Hunt for outbound connections or new services on affected appliances that could indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.