{"id":"CVE-2022-40684","published":"2022-10-18T14:15:09Z","modified":"2026-08-06T05:16:37Z","title":"Fortinet Multiple Products Authentication Bypass Vulnerability","vendor":"Fortinet","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an authentication bypass affecting multiple Fortinet products, namely FortiOS, FortiProxy and FortiSwitchManager, caused by an alternate path or channel that skips normal authentication on the administrative interface. An unauthenticated attacker with network access can send specially crafted HTTP or HTTPS requests to perform operations on the administrative interface, requiring no credentials and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:56:52Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99984,"percentile":0.99983,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-10-11","dueDate":"2022-11-01","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.fortiguard.com/psirt/FG-IR-22-377;  https://nvd.nist.gov/vuln/detail/CVE-2022-40684","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-10-10","exploitedFirstSeen":"2022-10-10","ransomware":true,"evidence":[{"url":"https://www.fortiguard.com/psirt/FG-IR-22-377","date":"2022-10-10"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-10-11"},{"url":"https://blog.cyble.com/2022/11/24/multiple-organisations-compromised-by-critical-authentication-bypass-vulnerability-in-fortinet-products-cve-2022-40684/","date":"2022-11-24"},{"url":"https://web.archive.org/web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022/","date":"2023-01-12"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign","date":"2023-06-12"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-215a","date":"2023-08-03"},{"url":"https://information.rapid7.com/rs/411-NAK-970/images/Rapid7-2023-Mid-Year-Threat-Review.pdf","date":"2023-08-17"},{"url":"https://stairwell.com/resources/akira-pulling-on-the-chains-of-ransomware/","date":"2023-08-23"},{"url":"https://blog.bushidotoken.net/2023/09/tracking-adversaries-akira-another.html","date":"2023-09-15"},{"url":"https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html","date":"2023-09-18"}],"evidenceTotal":877,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://fortiguard.com/psirt/FG-IR-22-377","tags":["Mitigation","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://fortiguard.com/psirt/FG-IR-22-377","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This authentication bypass vulnerability allows an adversary to create an admin ssh key via any HTTP method. ","confidence":"high"},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This authentication bypass vulnerability allows an adversary to create an admin ssh key via any HTTP method. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-43955","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43955","exploited":true,"exploitedSince":"2022-10-11","provenance":"source"},"exploits":[{"id":51092,"url":"https://www.exploit-db.com/exploits/51092","title":"FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass","type":"webapps","platform":"multiple","date":"2023-03-27","verified":false,"provenance":"source"},{"id":52239,"url":"https://www.exploit-db.com/exploits/52239","title":"Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass","type":"remote","platform":"windows","date":"2025-04-16","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2023-03-27"},"pocGithub":{"count":26,"skipped":5,"earliest":"2022-10-13","earliestUrl":"https://github.com/horizon3ai/CVE-2022-40684","repos":[{"name":"horizon3ai/CVE-2022-40684","url":"https://github.com/horizon3ai/CVE-2022-40684","stars":358,"created":"2022-10-13"},{"name":"carlosevieira/CVE-2022-40684","url":"https://github.com/carlosevieira/CVE-2022-40684","stars":87,"created":"2022-10-13"},{"name":"arsolutioner/fortigate-belsen-leak","url":"https://github.com/arsolutioner/fortigate-belsen-leak","stars":87,"created":"2025-01-16"},{"name":"Filiplain/Fortinet-PoC-Auth-Bypass","url":"https://github.com/Filiplain/Fortinet-PoC-Auth-Bypass","stars":16,"created":"2022-10-13"},{"name":"kljunowsky/CVE-2022-40684-POC","url":"https://github.com/kljunowsky/CVE-2022-40684-POC","stars":16,"created":"2022-10-13"}]},"metasploit":[{"name":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager authentication bypass.","module":"exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684","type":"exploit","disclosureDate":"2022-10-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb"}],"nuclei":[{"id":"CVE-2022-40684","name":"Fortinet - Authentication Bypass","severity":"critical","path":"http/cves/2022/CVE-2022-40684.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml"}],"first":{"date":"2022-10-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html","http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1098.004"],"provenance":"source"}],"timeline":[{"date":"2022-10-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-10-13, Exploit-DB 2023-03-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb","provenance":"source"},{"date":"2022-10-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortiguard.com/psirt/FG-IR-22-377","provenance":"source"},{"date":"2022-10-11","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-10-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43955","provenance":"source"},{"date":"2022-10-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40684","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1482 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 26 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}