CVE-2022-40684

The vulnerability in Fortinet's FortiOS, FortiProxy, and FortiSwitchManager products represents a critical authentication bypass issue that allows unauthenticated attackers to exploit the administrative interfaces of these systems. This flaw arises from the improper validation of authentication tokens, enabling attackers to send specially crafted HTTP or HTTPS requests that can bypass security measures. The affected versions include FortiOS 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, as well as FortiProxy and FortiSwitchManager within the same version ranges. The severity of this vulnerability is underscored by its high CVSS score of 9.8, indicating that it poses a significant risk to organizations utilizing these products.

Attack vectors for this vulnerability are particularly concerning due to the ease with which an attacker can exploit it. By leveraging the authentication bypass, an attacker can gain unauthorized access to the administrative interfaces of the affected products. This could involve sending crafted requests that manipulate the underlying protocols, allowing the attacker to perform administrative functions without needing valid credentials. Scenarios may include altering configurations, accessing sensitive data, or even deploying malicious payloads that could further compromise the network. The simplicity of the attack, combined with the potential for significant control over critical network infrastructure, makes this vulnerability especially dangerous.

The real-world impact of this vulnerability can be profound for organizations that rely on Fortinet's products for their security infrastructure. An attacker gaining administrative access could lead to data breaches, service disruptions, and unauthorized changes to security policies, all of which could have severe financial and reputational repercussions. For businesses, the risk extends beyond immediate damage; regulatory compliance issues may arise if sensitive data is exposed or if the organization fails to protect its systems adequately. The potential for widespread exploitation means that organizations must take this threat seriously and act swiftly to mitigate the risks.

To detect and mitigate the threat posed by this vulnerability, organizations should implement a multi-layered security approach. Regularly updating and patching affected systems is crucial, as Fortinet has released updates to address this flaw. Additionally, monitoring network traffic for unusual patterns or unauthorized access attempts can help identify potential exploitation in real-time. Employing intrusion detection systems (IDS) and conducting regular security audits can further bolster defenses. Organizations should also consider implementing strict access controls and segmentation within their networks to limit the potential impact of an attacker gaining unauthorized access.

In conclusion, the authentication bypass vulnerability in Fortinet's products presents a significant threat to network security. Its ease of exploitation and potential for severe consequences necessitate immediate attention from organizations using these systems. By understanding the technical details, potential attack vectors, and real-world implications, as well as employing robust detection and mitigation strategies, organizations can better protect themselves against this critical vulnerability. Proactive measures and a commitment to security best practices will be essential in safeguarding against the risks associated with this and similar vulnerabilities in the future.

CSURFACE threat intelligence has detected a slight increase in activity related to CVE-2022-40684, indicating continued exploitation attempts targeting Fortinet FortiOS, FortiProxy, and FortiSwitchManager. This uptick, while modest, underscores persistent adversary interest and operational use, particularly by ransomware groups such as Akira, which remain actively associated with campaigns leveraging this vulnerability. The availability of multiple new proof-of-concept exploits on public repositories has likely contributed to sustained attacker engagement, lowering the barrier for exploitation and facilitating broader targeting. Although the EPSS score remains high and stable, the incremental rise in detection signals that threat actors are maintaining or marginally expanding their operational tempo rather than diminishing activity. For defenders, this means that vigilance must be sustained as the vulnerability continues to be a viable vector for unauthorized administrative access and subsequent ransomware deployment. The threat level remains critical, with the evolving exploit landscape and ransomware associations reinforcing the urgency for ongoing monitoring and response readiness.

Update 2 — June 21, 2026

CSURFACE threat intelligence has identified a modest increase in exploitation attempts targeting CVE-2022-40684, reflected by a slight rise in detection signals and an elevated EPSS score nearing certainty of exploitation. This subtle uptick indicates sustained adversary interest, with threat actors continuing to leverage this critical authentication bypass vulnerability to gain unauthorized administrative access. The persistence of ransomware groups such as Akira in campaigns exploiting this flaw underscores the ongoing operational relevance of this vulnerability. Additionally, the emergence of multiple new proof-of-concept exploits circulating publicly enhances the accessibility of attack tools, potentially lowering the barrier for less sophisticated actors to conduct impactful intrusions. For defenders, this evolving landscape signals that the threat remains active and adaptive, necessitating continued vigilance. While the increase is not yet characterized as a rapid surge, the trend confirms that exploitation activity is stable or incrementally growing, maintaining the vulnerability’s critical risk profile and its role as a vector for ransomware deployment.

Update 3 — July 06, 2026

CSURFACE threat intelligence has identified a slight increase in exploitation attempts targeting CVE-2022-40684, consistent with a gradual upward trend in attacker activity. This subtle rise in telemetry correlates with continued dissemination of multiple new proof-of-concept exploits, which remain publicly accessible and contribute to lowering the technical barrier for threat actors. Notably, ransomware groups associated with this vulnerability, such as Akira, continue to leverage it as a reliable vector for initial access, underscoring the persistent operational value of this flaw. While the overall exploit landscape remains stable without signs of a rapid surge, the incremental growth in activity reinforces the vulnerability’s critical status and sustained attractiveness to adversaries. For defenders, this evolving pattern signals the necessity to maintain heightened monitoring and response capabilities, as the threat remains active and capable of facilitating impactful intrusions.