Vendor

Fortinet

Vulnerabilities in FortiOS, FortiGate, and FortiProxy — the firewall and SSL-VPN appliances that sit at the network edge, making a single auth-bypass or overflow bug a direct path to full network compromise.

CVEs

CVE-2022-40684

[ CRITICAL ] kev

FortiOS / FortiProxy Authentication Bypass on Administrative Interface

An authentication-bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows a remote attacker to perform administrative operations on the management interface via crafted HTTP(S) requests, including adding a new administrator SSH key for persistent access.

Fortinet / FortiOS / FortiProxy Oct 10, 2022

Articles

~/articles/2026-07-03-fortios-fortiproxy-auth-bypass-cve-2022-40684

Explainer

fortinet

FortiOS Auth Bypass: Why Fortinet Warned Select Customers Before Going Public

CVE-2022-40684 let attackers bypass authentication on FortiOS and FortiProxy management interfaces and plant persistent SSH keys — Fortinet quietly warned targeted customers before public disclosure.

Jul 3 read →