CVE Watch—

CVE-2022-40684

Fortinet Multiple Products Authentication Bypass Vulnerability

CVSS

—

No CVSS

EPSS

100.0%

p100

KEV

YES

Oct 11, 2022

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

100.0%EPSS · 30 days100.0%

2026-06-302026-07-16

KEV catalog record

Product

Fortinet / Multiple Products

Vulnerability

Fortinet Multiple Products Authentication Bypass Vulnerability

Added to KEV

Oct 11, 2022

Remediate by

Nov 1, 2022

Known ransomware use

Yes

Summary description

Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Required action

Apply updates per vendor instructions.

Notes

https://www.fortiguard.com/psirt/FG-IR-22-377; https://nvd.nist.gov/vuln/detail/CVE-2022-40684

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-24858—

99.7%

KEV—80Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability—CVE-2025-59718—

99.2%

KEV—80Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability—CVE-2024-23113—

99.1%

KEV—80Fortinet Multiple Products Format String Vulnerability—CVE-2025-32756—

98.1%

KEV—79Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability—