# CVE-2022-40684: Fortinet Multiple Products Authentication Bypass Vulnerability

- Exploited (CISA KEV): yes, added 2022-10-11, known ransomware use
- Published: 2022-10-18
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 100.0% (100th percentile)
- CWE: CWE-288

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-02-11 | 847 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-02-11 · new · rule 05842b06f0a4415880b58f7fbf72cf8a · default Block
  > FortiOS - Auth Bypass - CVE:CVE-2022-40684. Previous action: Log. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-02-11-waf-release/

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: partial (1 of 2 requests blocked), template CVE-2022-40684, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: partial (1 of 2 requests blocked), template CVE-2022-40684, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2022-40684 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2022-40684