Every CVE Search/ Get API key

CVE-2022-40684

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version...

9.8 CriticalIn KEVPublic exploit

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 84.8 points since Oct 19, 2022
90%50%10%1%

What each source reports

CVE List Score used 9.8

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Record
CVE-2022-40684
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2022-43955 9.8

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Record
EUVD-2022-43955
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-m3wm-rjvf-m778 9.8

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version...

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Record
GHSA-m3wm-rjvf-m778
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-306
Updated
2026-11-02
CISA KEV No score

Fortinet Multiple Products Authentication Bypass Vulnerability

Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Record
CVE-2022-40684
Weakness
CWE-288
Updated
2026-11-02
NVD 9.8

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Record
CVE-2022-40684
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitFortinet FortiOS, FortiProxy, and FortiSwitchManager authentication bypass.2022-10-10
PoC in GitHubFiliplain/Fortinet-PoC-Auth-Bypass2022-10-13
PoC in GitHubcarlosevieira/CVE-2022-406842022-10-13
PoC in GitHubhorizon3ai/CVE-2022-406842022-10-13
PoC in GitHubkljunowsky/CVE-2022-40684-POC2022-10-13
PoC in GitHubiveresk/CVE-2022-406842022-10-14
PoC in GitHubmhd108/CVE-2022-406842022-10-14
PoC in GitHubsecunnix/CVE-2022-406842022-10-14
PoC in GitHubChocapikk/CVE-2022-406842022-10-15
PoC in GitHubClickCyber/cve-2022-406842022-10-15
Show 19 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubHAWA771/CVE-2022-406842022-10-15
PoC in GitHubNeriaBasha/CVE-2022-406842022-10-16
PoC in GitHubxtwip/fortipwn2022-10-16
PoC in GitHubjsongmax/Fortinet-CVE-2022-406842022-10-17
PoC in GitHubpuckiestyle/CVE-2022-406842022-10-17
PoC in GitHubund3sc0n0c1d0/CVE-2022-406842022-10-19
PoC in GitHubqingsiweisan/CVE-2022-406842022-10-26
PoC in GitHubTaroballzChen/CVE-2022-40684-metasploit-scanner2022-10-27
PoC in GitHubgustavorobertux/gotigate2022-10-27
PoC in GitHubhughink/CVE-2022-406842022-10-28
PoC in GitHubnotareaperbutDR34P3r/CVE-2022-40684-Rust2023-01-17
PoC in GitHubdkstar11q/CVE-2022-406842023-01-28
PoC in GitHubz-bool/CVE-2022-406842023-02-27
Exploit-DBFortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass2023-03-27
PoC in GitHubAnthony1500/CVE-2022-406842023-09-14
PoC in GitHubarsolutioner/fortigate-belsen-leak2025-01-16
PoC in GitHubXalfiE/Fortigate-Belsen-Leak-Dump-CVE-2022-40684-2025-01-23
Exploit-DBFortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass2025-04-16
NucleiFortinet - Authentication Bypass

Plus 6 more. The full list has every link.

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-40684 is a critical vulnerability (CVSS 9.8) in Fortinet Fortios, published October 18, 2022. CISA lists it as known to be exploited, since October 11, 2022. EUVD reports exploitation since October 11, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open