Vulnerabilities/Fortinet/CVE-2022-40684
CVE-2022-40684: Fortinet Multiple Products Authentication Bypass Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownFix: Unknown
CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 11 Oct 2022
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Recommended action
Apply updates per vendor instructions.
CISA due date 1 Nov 2022 · CWE-288
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiOS, FortiProxy, FortiSwitchManager | FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0 | Unknown |
No source states a fixed version. Check the vendor advisory below.
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 11 Oct 2022 · Added to CISA KEV
- 1 Nov 2022 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.