CVE-2022-40684

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Affected

Fortinet · Fortinet FortiOS, FortiProxy, FortiSwitchManager

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

99.98% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-10-11, used in ransomware campaigns

Nuclei

critical · CWE-287

Published

2022-10-18

Updated

2026-08-06

Proof-of-concept exploits (29)

• http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManage…
• http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html
• Anthony1500/CVE-2022-406840★ · 2023-09-14
• Bendalledj/CVE-2022-406841★ · 2022-10-21
• Chocapikk/CVE-2022-406847★ · 2022-10-19
• ClickCyber/cve-2022-406840★ · 2022-10-15
• Filiplain/Fortinet-PoC-Auth-Bypass16★ · 2023-04-02
• HAWA771/CVE-2022-406842★ · 2022-10-15
• NeriaBasha/CVE-2022-406841★ · 2022-10-16
• XalfiE/Fortigate-Belsen-Leak-Dump-CVE-2022-40684-1★ · 2025-02-05
• Yami0x777/Belsen_Group-et-exploitation-de-la-CVE-2022-406840★ · 2025-02-20
• carlosevieira/CVE-2022-4068487★ · 2022-10-13
• dkstar11q/CVE-2022-406840★ · 2022-10-15
• gustavorobertux/gotigate2★ · 2022-10-28
• horizon3ai/CVE-2022-40684358★ · 2022-10-13
• iveresk/CVE-2022-406841★ · 2022-10-17
• jsongmax/Fortinet-CVE-2022-406842★ · 2022-10-17
• kljunowsky/CVE-2022-40684-POC16★ · 2023-01-21
• mhd108/CVE-2022-406840★ · 2022-10-14
• notareaperbutDR34P3r/CVE-2022-40684-Rust0★ · 2023-01-17
• puckiestyle/CVE-2022-406840★ · 2022-10-17
• qingsiweisan/CVE-2022-406849★ · 2022-10-26
• secunnix/CVE-2022-406845★ · 2022-10-14
• und3sc0n0c1d0/CVE-2022-406844★ · 2022-10-24
• z-bool/CVE-2022-406845★ · 2023-02-27
• ccordeiro/CVE-2022-406840★ · 2025-11-19
• 1337or420/FortiGate-FortiWeb-Multi-Exploit-Extractor2★ · 2026-09-17
• tijldeneut/Security157★ · 2026-09-28
• gotr00t0day/CVE-2022-406840★ · 2026-10-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authenticati…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/52239
• https://www.exploit-db.com/exploits/51092

Exploit collections (1)

• CVE-2022-40684.yamlzan8in/afrog

Security advisories

• https://fortiguard.com/psirt/FG-IR-22-377

References

• CVE Record
• NVD entry

Related

• CVE-2022-42889
• CVE-2023-30330
• CVE-2021-26084
• CVE-2022-0847
• CVE-2022-22947
• CVE-2022-31814