Is CVE-2022-40684 being actively exploited?

Yes. CVE-2022-40684 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on October 11, 2022.

What is the CVSS score for CVE-2022-40684?

CVE-2022-40684 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2022-40684

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 100.0%EU EUVD: exploited

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-287
EPSS score: 100.0% (100th percentile)
In CISA KEV: Yes, added October 11, 2022
In EU EUVD: Yes (EUVD-2022-43955)
Published: October 18, 2022
NVD last modified: August 6, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Fortinet Multiple Products Authentication Bypass Vulnerability

Added to the KEV catalog on October 11, 2022; federal remediation due November 1, 2022. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2022-43955 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on August 6, 2026.

View on the EU Vulnerability Database

Affected products

fortinet / fortios
fortinet / fortiproxy
fortinet / fortiproxy
fortinet / fortiswitchmanager
fortinet / fortiswitchmanager

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

FortiOS 7.2/7.4 - Fortinet, Inc. - FIPS 140 5564 - active

References

http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
https://fortiguard.com/psirt/FG-IR-22-377(Mitigation, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain