Fortinet has confirmed that the critical vulnerability whose existence came to light last week is a zero-day flaw that has been exploited in at least one attack.
The company privately informed some customers last week about the availability of patches and workarounds for an authentication bypass vulnerability exposing FortiOS and FortiProxy products to remote attacks.
The flaw, tracked as CVE-2022-40684, can allow a remote, unauthenticated attacker to perform unauthorized operations on the targeted appliance’s admin interface using specially crafted HTTP or HTTPS requests.
Fortinet on Monday made public an advisory for CVE-2022-40684 and warned that it’s aware of one attack involving exploitation of the zero-day. The company has provided an indicator of compromise (IoC) that customers can use to check if their appliances have been hacked.
It’s likely that exploitation of the vulnerability occurred before Fortinet released a patch. Limited exploitation of a security flaw typically suggests that a sophisticated threat actor — likely a state-sponsored group — is behind the attacks.
However, details and proof-of-concept (PoC) exploits are expected to become publicly available in the coming days, which will allow other threat actors to add the exploit to their toolset.
Researcher Carlos Vieira said the vulnerability is “really simple to exploit and easy to weaponize” and warned that exploitation can lead to a full device takeover.
SANS Institute reported seeing an increase in scans for an old Fortigate vulnerability and the company believes someone may be trying to create a list of potential targets for CVE-2022-40684 exploitation.
According to Fortinet’s advisory, in addition to FortiProxy web gateways and security appliances running FortiOS, the flaw impacts FortiSwitch Manager, the management platform for FortiSwitch switches. Versions 7.0.x and 7.2 are affected and patches are included in versions 7.0.7, 7.2.1 and 7.2.2.
There are many vulnerable devices that are exposed to the internet, which makes widespread exploitation very likely. It’s not uncommon for threat actors to target Fortinet devices in their attacks.
Related: Vulnerabilities in Fortinet WAF Can Expose Corporate Networks to Attacks
Related: Fortinet Patches High-Severity Vulnerabilities in Several Products
Related: Tens of Thousands of Unpatched Fortinet VPNs Hacked via Old Security Flaw

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Hive Ransomware Operation Shut Down by Law Enforcement
- UK Gov Warns of Phishing Attacks Launched by Iranian, Russian Cyberspies
- Dozens of Cybersecurity Companies Announced Layoffs in Past Year
- Security Update for Chrome 109 Patches 6 Vulnerabilities
- New Open Source OT Security Tool Helps Address Impact of Upcoming Microsoft Patch
- Forward Networks Raises $50 Million in Series D Funding
Latest News
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- Microsoft Urges Customers to Patch Exchange Servers
- Iranian APT Leaks Data From Saudi Arabia Government Under New Persona
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Cyberattacks Target Websites of German Airports, Admin
- US Infiltrates Big Ransomware Gang: ‘We Hacked the Hackers’
