CVE-2022-40684

Confirmed PUBLISHED

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6,...

Fortinet · Fortinet FortiOS, FortiProxy, FortiSwitchManager

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

metasploit edge ransomware nuclei_scanner ios malware cisa

CVE Published: Oct 18, 2022
Exploitation Reported: Oct 11, 2022
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Fortinet	Fortinet FortiOS, FortiProxy, FortiSwitchManager	FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0	Affected

CVE References

fortiguard.com/psirt/FG-IR-22-377 fortiguard.com · CVE Record https://fortiguard.com/psirt/FG-IR-22-377
packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-For... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiPro...
packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-B... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentica...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-10-11 00:00 UTC
The Shadowserver	2026-06-01 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2022-10-11 00:00:00 UTC · CISA

Used in malware

Recorded 2022-10-11 00:00:00 UTC · CISA

Proof of concept available

Recorded 2022-10-13 14:24:12 UTC · GitHub

Weaknesses (CWE)

CWE-287

Improper Authentication

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml	Apr 25, 2025

Recent Mentions

CVE-2025-32756: Zero-Day Vulnerability in Multiple Fortinet Products Exploited in the Wild

Tenable Blog · May 14, 2025

Fortinet has observed threat actors exploiting CVE-2025-32756, a critical zero-day arbitrary code execution vulnerability which affects multiple Fortinet products including FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera.BackgroundOn May 13th, Fortinet published a security advisory (FG-IR-25-254) for CVE-2025-32756, a critical arbitrary code execution vulnerability affecting multiple Fortinet products.CVEDescriptionCVSSv3CVE-2025-32756An arbitrary code execution vulnerability in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera9.6AnalysisCVE-2025-32756 is an arbitrary code execution vulnerability affecting multiple Fortinet products including FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera. A remote unauthenticated attacker can send crafted HTTP requests in order to create a stack-based overflow condition which would allow for the execution of arbitrary code. This vulnerability was discovered by the Fortinet Product Security Team who observed threat activity involving a device running FortiVoice.According to Fortinet, the threat actors operations included scanning the network, erasing system crashlogs and enabling ‘fcgi debugging’ which is used to log authentication attempts, including SSH logins. The ‘fcgi debugging’ option is not enabled by default and the Fortinet advisory recommends reviewing the setting as one possible indicator of compromise (IoC).Historical Exploitation of Fortinet DevicesFortinet vulnerabilities have historically been common targets for cyber attackers, and CVE-2025-32756 is the eighteenth Fortinet vulnerability to be added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) list.CVEDescriptionPatchedTenable BlogCVE-2024-55591Fortinet Authentication Bypass in FortiOS and FortiProxyJanuary 2025CVE-2024-55591: Fortinet Authentication Bypass Zero-Day Vulnerability Exploited in the WildCVE-2024-21762Fortinet FortiOS Out-of-bound Write Vulnerability...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

z-bool/CVE-2022-40684

github · Created 2023-02-27 18:05:34 UTC · 5 stars

一键枚举所有用户名以及写入SSH公钥

hughink/CVE-2022-40684

github · Created 2022-10-28 03:46:00 UTC · 10 stars

TaroballzChen/CVE-2022-40684-metasploit-scanner

github · Created 2022-10-27 15:11:27 UTC · 14 stars

An authentication bypass using an alternate path or channel in Fortinet product

qingsiweisan/CVE-2022-40684

github · Created 2022-10-26 01:48:14 UTC · 10 stars

und3sc0n0c1d0/CVE-2022-40684

github · Created 2022-10-19 22:07:24 UTC · 4 stars

Utilities for exploiting vulnerability CVE-2022-40684 (FortiOS / FortiProxy / FortiSwitchManager - Authentication bypass on administrative interface).

jsongmax/Fortinet-CVE-2022-40684

github · Created 2022-10-17 09:22:57 UTC · 2 stars

HAWA771/CVE-2022-40684

github · Created 2022-10-15 19:43:48 UTC · 2 stars

Fortinet Critical Authentication Bypass Vulnerability (CVE-2022-40684) [ Mass Exploit ]

mohamedbenchikh/CVE-2022-40684

github · Created 2022-10-15 17:02:49 UTC · 4 stars

Exploit for CVE-2022-40684 vulnerability

Chocapikk/CVE-2022-40684

github · Created 2022-10-15 16:51:25 UTC · 5 stars

Fortinet Critical Authentication Bypass Vulnerability (CVE-2022-40684) [ Mass Exploit ]

secunnix/CVE-2022-40684

github · Created 2022-10-14 01:07:01 UTC · 5 stars

kljunowsky/CVE-2022-40684-POC

github · Created 2022-10-13 21:07:50 UTC · 15 stars

Exploit for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager

carlosevieira/CVE-2022-40684

github · Created 2022-10-13 18:13:59 UTC · 87 stars

PoC for CVE-2022-40684 - Authentication bypass lead to Full device takeover (Read-only)

horizon3ai/CVE-2022-40684

github · Created 2022-10-13 14:24:12 UTC · 349 stars

A proof of concept exploit for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager

Fortinet - Authentication Bypass

nuclei · Created Unknown

fortinet_authentication_bypass_cve_2022_40684

metasploit · Created Unknown

Metasploit module for CVE-2022-40684

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
18 Oct 2022 00:00 UTC almost 4 years ago

18 Oct 2022 00:00 UTC · almost 4 years ago

CVE published

Vulnerability disclosed publicly
13 Oct 2022 14:24 UTC almost 4 years ago

13 Oct 2022 14:24 UTC · almost 4 years ago

Public PoC available

Public proof-of-concept code published
11 Oct 2022 00:00 UTC almost 4 years ago

11 Oct 2022 00:00 UTC · almost 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
11 Oct 2022 00:00 UTC almost 4 years ago

11 Oct 2022 00:00 UTC · almost 4 years ago

First public exploitation report

Exploit observed in malware
14 Sep 2022 00:00 UTC almost 4 years ago

14 Sep 2022 00:00 UTC · almost 4 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2022-40684

{
  "cve_id": "CVE-2022-40684",
  "title": "An authentication bypass using an alternate path or channel [CWE-288] in Fort...",
  "affected_vendor": "Fortinet",
  "affected_product": "Fortinet FortiOS, FortiProxy, FortiSwitchManager",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99984,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2022-40684

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API