CVE DatabaseCVE-2022-40684

Updated 2026-08-06한국어 권고문 →

CVE-2022-406849.8/CRITICALCISA KEVCWE-287CWE-287

Fortinet FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Vulnerability (CVE-2022-40684) Security Advisory

⚡ Jump to Patch

Affected Vendors

fortinet

Affected Components

fortios, fortiproxy, fortiswitchmanager

Published Date

2022-10-18

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

FortiOS (7.2.0 to 7.2.1, 7.0.0 to 7.0.6), FortiProxy (7.2.0, 7.0.0 to 7.0.6), FortiSwitchManager (7.2.0, 7.0.0)

Impact

An unauthenticated remote attacker can bypass authentication via specially crafted HTTP/HTTPS requests, gaining full administrative access to perform arbitrary operations

Mitigation

Immediately upgrade to patched versions (FortiOS 7.2.2 / 7.0.7 or higher) or disable HTTP/HTTPS administrative access from untrusted networks

Affected Products & Version Scope

FortiOS versions 7.2.0 to 7.2.1, 7.0.0 to 7.0.6 / FortiProxy versions 7.2.0, 7.0.0 to 7.0.6 / FortiSwitchManager versions 7.2.0, 7.0.0

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

It is highly recommended to upgrade to the patched versions immediately. The secure versions are:

FortiOS: 7.2.2 or higher, 7.0.7 or higher
FortiProxy: 7.2.1 or higher, 7.0.7 or higher
FortiSwitchManager: 7.2.1 or higher, 7.0.1 or higher

Example CLI command to upgrade firmware via TFTP:

bash

# Download and apply the secure firmware image
execute restore image tftp FGT_60F-v7.2.2.F-build1234-FORTINET.out 192.168.1.100

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, disable HTTP/HTTPS administrative access on all public-facing interfaces or restrict access to trusted IP addresses using Local In Policies.

bash

# Disable HTTP/HTTPS administrative access on port1
config system interface
    edit 'port1'
        set allowaccess ping ssh
    next
end

# Restrict administrative access to trusted IP ranges only
config system admin
    edit 'admin'
        set trusthost1 192.168.10.0 255.255.255.0
    next
end

3. Log Audit & IoC Verification Commands

Inspect system logs for indicators of compromise (IoCs), specifically looking for API requests originating from unexpected user agents like 'Report-Runner' or 'Node.js' associated with the 'admin' user.

bash

# Filter and display system logs for suspicious administrative API activity
execute log filter category event
execute log filter field subtype system
execute log filter field action dashboard
execute log display | grep -E 'user="admin".*Report-Runner'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild, immediately disable public-facing administrative interfaces and upgrade all affected Fortinet appliances to the latest secure releases.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-40684) is a critical authentication bypass using an alternate path or channel (CWE-288/CWE-287) within the REST API of Fortinet products. The root cause lies in the improper validation of internal trust relationships. When processing incoming HTTP requests, the system incorrectly trusts requests containing specific HTTP headers (such as 'Report-Key' or 'User-Agent'), treating them as if they originated from internal trusted processes (e.g., local loopback 127.0.0.1), thereby bypassing authentication checks entirely.

2. Exploitation Mechanics & Attack Scenario

An attacker sends a crafted HTTP or HTTPS request to the exposed administrative interface of the target device. By manipulating headers such as 'User-Agent: Report-Runner' and 'Forwarded: for="[127.0.0.1]";by="[127.0.0.1]"', the internal API gateway is misled into believing the request is an authorized internal system call. This allows the attacker to bypass authentication and perform administrative actions, such as adding new administrative users, modifying system configurations, or uploading SSH keys to achieve persistent Remote Code Execution (RCE).

3. Infrastructure & Business Impact

FortiOS firewalls and FortiProxy appliances serve as critical perimeter security gateways. With a CVSS score of 9.8 and active exploitation documented in CISA's KEV catalog, this vulnerability poses an extreme risk. Successful exploitation grants complete control over the network gateway, enabling attackers to intercept traffic, compromise VPN sessions, pivot laterally into the internal network, or deploy ransomware, leading to catastrophic business disruption.

Official Vendor Advisories & References

NVD Original English Description

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html

Source: psirt@fortinet.com · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html

Source: psirt@fortinet.com · Exploit, Third Party Advisory, VDB Entry

https://fortiguard.com/psirt/FG-IR-22-377

Source: psirt@fortinet.com · Mitigation, Vendor Advisory

http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://fortiguard.com/psirt/FG-IR-22-377

Source: af854a3a-2127-422b-91ae-364da2661108 · Mitigation, Vendor Advisory

Frequently Asked SecOps Questions (CVE-2022-40684)

FAQ

Q1. How critical is CVE-2022-40684 and is it actively exploited in the wild?

CVE-2022-40684 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2022-40684?

Primary impacted vendors include fortinet across fortios, fortiproxy, fortiswitchmanager. Scope summary: FortiOS versions 7.2.0 to 7.2.1, 7.0.0 to 7.0.6 / FortiProxy versions 7.2.0, 7.0.0 to 7.0.6 / FortiSwitchManager versions 7.2.0, 7.0.0

Q3. What temporary mitigations or workarounds exist for CVE-2022-40684 before patching?

[Mitigation] Immediately upgrade to patched versions (FortiOS 7.2.2 / 7.0.7 or higher) or disable HTTP/HTTPS administrative access from untrusted networks Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION