Loading story…
Attackers began exploiting Fortinet authentication bypass flaw CVE-2022-40684 against internet-facing devices shortly after the vulnerability was disclosed, according to SOC observations. The issue affects FortiOS, FortiProxy, and FortiSwitchManager, and allows unauthenticated attackers to send crafted HTTP/HTTPS requests that bypass authentication and gain access to the administrative interface.
Observed attacks started within days of disclosure, with defenders warning that public proof-of-concept code could accelerate broader exploitation. Organizations were urged to upgrade affected versions immediately or apply Fortinet’s mitigations, including disabling HTTP/HTTPS administrative access where possible and restricting administrative interface access to trusted IP addresses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC reported seeing attacks exploiting CVE-2022-40684 beginning on October 14, 2022, shortly after disclosure. The observed payload used an HTTP PUT request to /api/v2/cmdb/system/admin/admin with a forged Forwarded header and attempted to set an ssh-public-key1 value.
Fortinet publicly disclosed CVE-2022-40684 on October 10, 2022. The vulnerability affects FortiOS, FortiProxy, and FortiSwitchManager and allows authentication bypass via crafted HTTP/HTTPS requests to administrative interfaces.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026
CISA has added two critical authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719, affecting multiple Fortinet products—including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager—to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. These flaws stem from improper verification of cryptographic signatures in the FortiCloud Single Sign-On (SSO) mechanism, allowing unauthenticated attackers to bypass authentication via specially crafted SAML messages. Fortinet has released advisories and patches, and CISA has set a remediation deadline for federal agencies, urging immediate patching or, if not possible, discontinuation of affected products until mitigations are in place. The vulnerabilities are not enabled by default but can be activated during FortiCare registration unless administrators disable the relevant SSO toggle. Security researchers have observed exploitation attempts shortly after the patch release, highlighting the urgency for organizations to update their systems. CISA's guidance mandates compliance with BOD 22-01 for federal agencies, and all organizations using affected Fortinet products are strongly advised to apply patches or disable the vulnerable SSO feature to prevent unauthorized access to their networks.
Jun 29, 2026