CVE-2022-39952

The vulnerability in Fortinet's FortiNAC arises from an external control of file names or paths, which can be exploited by an unauthenticated attacker. This flaw allows the attacker to craft specific HTTP requests that can lead to the execution of unauthorized code or commands on the affected systems. The issue is particularly concerning due to the nature of FortiNAC, which is designed to manage and secure network access control for devices within an organization. The ability to manipulate file paths or names poses a significant risk, as it can lead to arbitrary code execution, potentially compromising the integrity and confidentiality of the entire network.

Attack vectors for this vulnerability are primarily through crafted HTTP requests targeting the FortiNAC service. An attacker could leverage this flaw by sending specially designed requests that manipulate file paths, leading to the execution of malicious code on the server. This exploitation could occur remotely, making it accessible to threat actors without requiring physical access to the network. Scenarios may include an attacker using phishing techniques to lure an employee into clicking a malicious link or directly targeting the FortiNAC system through automated scripts that probe for vulnerable endpoints. The ease of exploitation, combined with the lack of authentication requirements, amplifies the threat posed by this vulnerability.

The real-world impact of this vulnerability can be severe, particularly for organizations relying on FortiNAC for network security. Successful exploitation could lead to unauthorized access to sensitive data, disruption of network services, or even the establishment of persistent backdoors for future attacks. The potential for data breaches can result in significant financial losses, reputational damage, and regulatory penalties, especially in industries governed by strict data protection laws. Furthermore, the high CVSS score of 9.8 indicates that this vulnerability is critical, necessitating immediate attention from security teams to mitigate the associated risks.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating FortiNAC to the latest versions that address this flaw is essential. Additionally, employing intrusion detection systems (IDS) can help identify and alert on suspicious HTTP requests that may indicate an attempted exploitation. Network segmentation can also limit the potential impact of an attack by isolating critical systems from less secure areas of the network. Furthermore, organizations should conduct regular security assessments and penetration testing to identify and remediate vulnerabilities proactively.

In conclusion, the vulnerability within Fortinet's FortiNAC presents a significant threat to network security, with the potential for unauthorized code execution through crafted HTTP requests. The ease of exploitation and the severe implications for data integrity and availability underscore the importance of prompt detection and mitigation strategies. Organizations must prioritize updating their systems, monitoring network traffic for anomalies, and adopting a proactive security posture to safeguard against such vulnerabilities. By doing so, they can better protect their assets and maintain the trust of their stakeholders in an increasingly complex threat landscape.

CSURFACE threat intelligence has detected a slight increase in exploitation attempts targeting CVE-2022-39952, accompanied by the continued availability and refinement of multiple proof-of-concept exploits on public repositories. Our telemetry indicates that adversaries are maintaining steady interest in leveraging this vulnerability, with no significant change in the rapidity of exploit adoption but a discernible uptick in overall activity. This persistence underscores the vulnerability’s criticality given its unauthenticated remote code execution capability and the broad range of affected FortiNAC versions. The presence of a Metasploit module further lowers the barrier for exploitation, potentially expanding the attacker base beyond highly skilled threat actors. Consequently, the threat level remains elevated, with a sustained risk of unauthorized system compromise and lateral movement within affected networks.

Update 2 — June 13, 2026

CSURFACE threat intelligence has observed a slight increase in exploitation attempts targeting CVE-2022-39952, reflected by a modest uptick in detection activity across our sensors. While the overall exploit adoption rate remains stable, the persistence of publicly available proof-of-concept code and an established Metasploit module continues to facilitate opportunistic attacks by a broader range of adversaries, including less sophisticated actors. This sustained activity underscores the critical nature of the vulnerability, particularly given its unauthenticated remote code execution capability and the wide array of affected FortiNAC versions. Although there is no evidence of a rapid surge in exploitation, the incremental rise in attempts signals ongoing interest from threat actors and maintains elevated risk for organizations running vulnerable FortiNAC deployments.

Update 3 — June 21, 2026

CSURFACE threat intelligence has detected a slight increase in exploitation attempts targeting CVE-2022-39952, reflected in a modest rise in telemetry activity and an elevated EPSS score nearing certainty of exploitation. This incremental uptick, while not indicative of a rapid surge, signals persistent adversary interest and ongoing opportunistic targeting of vulnerable FortiNAC deployments. The continued availability of multiple proof-of-concept exploits and an established Metasploit module lowers the barrier to entry for threat actors, including less sophisticated groups, thereby sustaining the vulnerability’s critical risk profile. Defenders should remain vigilant as this steady exploitation activity underscores the persistent threat posed by unauthenticated remote code execution in widely deployed FortiNAC versions, maintaining a high likelihood of compromise in unpatched environments.