{"id":"CVE-2022-40684","aliases":["EUVD-2022-43955","GHSA-m3wm-rjvf-m778"],"status":"published","title":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version...","description":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.99984,"percentile":0.99983,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-287","CWE-288","CWE-306"],"published":"2022-10-18T00:00:00Z","modified":"2026-08-06T05:16:37Z","kev":{"date_added":"2022-10-11","due_date":"2022-11-01","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-10-11"},{"source":"kev","since":"2022-10-11"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684","title":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager authentication bypass.","type":"exploit","platform":"Linux,Unix","date":"2022-10-10","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684"},{"source":"pocgithub","id":"Filiplain/Fortinet-PoC-Auth-Bypass","title":"Filiplain/Fortinet-PoC-Auth-Bypass","date":"2022-10-13","url":"https://github.com/Filiplain/Fortinet-PoC-Auth-Bypass"},{"source":"pocgithub","id":"carlosevieira/CVE-2022-40684","title":"carlosevieira/CVE-2022-40684","date":"2022-10-13","url":"https://github.com/carlosevieira/CVE-2022-40684"},{"source":"pocgithub","id":"horizon3ai/CVE-2022-40684","title":"horizon3ai/CVE-2022-40684","date":"2022-10-13","url":"https://github.com/horizon3ai/CVE-2022-40684"},{"source":"pocgithub","id":"kljunowsky/CVE-2022-40684-POC","title":"kljunowsky/CVE-2022-40684-POC","date":"2022-10-13","url":"https://github.com/kljunowsky/CVE-2022-40684-POC"},{"source":"pocgithub","id":"iveresk/CVE-2022-40684","title":"iveresk/CVE-2022-40684","date":"2022-10-14","url":"https://github.com/iveresk/CVE-2022-40684"},{"source":"pocgithub","id":"mhd108/CVE-2022-40684","title":"mhd108/CVE-2022-40684","date":"2022-10-14","url":"https://github.com/mhd108/CVE-2022-40684"},{"source":"pocgithub","id":"secunnix/CVE-2022-40684","title":"secunnix/CVE-2022-40684","date":"2022-10-14","url":"https://github.com/secunnix/CVE-2022-40684"},{"source":"pocgithub","id":"Chocapikk/CVE-2022-40684","title":"Chocapikk/CVE-2022-40684","date":"2022-10-15","url":"https://github.com/Chocapikk/CVE-2022-40684"},{"source":"pocgithub","id":"ClickCyber/cve-2022-40684","title":"ClickCyber/cve-2022-40684","date":"2022-10-15","url":"https://github.com/ClickCyber/cve-2022-40684"},{"source":"pocgithub","id":"HAWA771/CVE-2022-40684","title":"HAWA771/CVE-2022-40684","date":"2022-10-15","url":"https://github.com/HAWA771/CVE-2022-40684"},{"source":"pocgithub","id":"NeriaBasha/CVE-2022-40684","title":"NeriaBasha/CVE-2022-40684","date":"2022-10-16","url":"https://github.com/NeriaBasha/CVE-2022-40684"},{"source":"pocgithub","id":"xtwip/fortipwn","title":"xtwip/fortipwn","date":"2022-10-16","url":"https://github.com/xtwip/fortipwn"},{"source":"pocgithub","id":"jsongmax/Fortinet-CVE-2022-40684","title":"jsongmax/Fortinet-CVE-2022-40684","date":"2022-10-17","url":"https://github.com/jsongmax/Fortinet-CVE-2022-40684"},{"source":"pocgithub","id":"puckiestyle/CVE-2022-40684","title":"puckiestyle/CVE-2022-40684","date":"2022-10-17","url":"https://github.com/puckiestyle/CVE-2022-40684"},{"source":"pocgithub","id":"und3sc0n0c1d0/CVE-2022-40684","title":"und3sc0n0c1d0/CVE-2022-40684","date":"2022-10-19","url":"https://github.com/und3sc0n0c1d0/CVE-2022-40684"},{"source":"pocgithub","id":"qingsiweisan/CVE-2022-40684","title":"qingsiweisan/CVE-2022-40684","date":"2022-10-26","url":"https://github.com/qingsiweisan/CVE-2022-40684"},{"source":"pocgithub","id":"TaroballzChen/CVE-2022-40684-metasploit-scanner","title":"TaroballzChen/CVE-2022-40684-metasploit-scanner","date":"2022-10-27","url":"https://github.com/TaroballzChen/CVE-2022-40684-metasploit-scanner"},{"source":"pocgithub","id":"gustavorobertux/gotigate","title":"gustavorobertux/gotigate","date":"2022-10-27","url":"https://github.com/gustavorobertux/gotigate"},{"source":"pocgithub","id":"hughink/CVE-2022-40684","title":"hughink/CVE-2022-40684","date":"2022-10-28","url":"https://github.com/hughink/CVE-2022-40684"},{"source":"pocgithub","id":"notareaperbutDR34P3r/CVE-2022-40684-Rust","title":"notareaperbutDR34P3r/CVE-2022-40684-Rust","date":"2023-01-17","url":"https://github.com/notareaperbutDR34P3r/CVE-2022-40684-Rust"},{"source":"pocgithub","id":"dkstar11q/CVE-2022-40684","title":"dkstar11q/CVE-2022-40684","date":"2023-01-28","url":"https://github.com/dkstar11q/CVE-2022-40684"},{"source":"pocgithub","id":"z-bool/CVE-2022-40684","title":"z-bool/CVE-2022-40684","date":"2023-02-27","url":"https://github.com/z-bool/CVE-2022-40684"},{"source":"exploitdb","id":"EDB-51092","title":"FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass","type":"webapps","platform":"multiple","date":"2023-03-27","url":"https://www.exploit-db.com/exploits/51092"},{"source":"pocgithub","id":"Anthony1500/CVE-2022-40684","title":"Anthony1500/CVE-2022-40684","date":"2023-09-14","url":"https://github.com/Anthony1500/CVE-2022-40684"},{"source":"pocgithub","id":"arsolutioner/fortigate-belsen-leak","title":"arsolutioner/fortigate-belsen-leak","date":"2025-01-16","url":"https://github.com/arsolutioner/fortigate-belsen-leak"},{"source":"pocgithub","id":"XalfiE/Fortigate-Belsen-Leak-Dump-CVE-2022-40684-","title":"XalfiE/Fortigate-Belsen-Leak-Dump-CVE-2022-40684-","date":"2025-01-23","url":"https://github.com/XalfiE/Fortigate-Belsen-Leak-Dump-CVE-2022-40684-"},{"source":"exploitdb","id":"EDB-52239","title":"Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass","type":"remote","platform":"windows","date":"2025-04-16","url":"https://www.exploit-db.com/exploits/52239"},{"source":"nuclei","id":"CVE-2022-40684","title":"Fortinet - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml"}],"exploits_more":6,"products":[{"vendor":"fortinet","product":"fortinet fortios, fortiproxy, fortiswitchmanager"},{"vendor":"fortinet","product":"fortios"},{"vendor":"fortinet","product":"fortiproxy"},{"vendor":"fortinet","product":"fortiswitchmanager"},{"vendor":"fortinet","product":"multiple products"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-377","tags":["x_transferred","Mitigation","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40684"},{"url":"https://github.com/advisories/GHSA-m3wm-rjvf-m778"}],"sources":{"cve":[{"id":"CVE-2022-40684","description":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","status":"published","published":"2022-10-18T00:00:00Z","modified":"2026-08-06T03:55:36.678Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:30.493103Z"}],"euvd":[{"id":"EUVD-2022-43955","description":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","status":"published","published":"2022-10-18T00:00:00Z","modified":"2026-08-06T03:55:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C","level":"critical"}],"exploited_since":"2022-10-11","updated_at":"2026-11-02T18:02:09.043832Z"}],"ghsa":[{"id":"GHSA-m3wm-rjvf-m778","title":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version...","description":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","status":"published","published":"2022-10-18T19:00:33Z","modified":"2025-10-22T00:32:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287","CWE-306"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2022-40684","title":"Fortinet Multiple Products Authentication Bypass Vulnerability","description":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","cwes":["CWE-288"],"kev":{"date_added":"2022-10-11","due_date":"2022-11-01","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-40684","description":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","status":"published","published":"2022-10-18T14:15:09.747Z","modified":"2026-08-06T05:16:37.827Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:30.6869Z"}]}}