CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Fortinet Multiple Products Authentication Bypass Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Affected products
fortinet: fortiproxy; fortinet: fortiswitchmanager; fortinet: fortios
References7
- fortiguard.com/psirt/FG-IR-22-377 MitigationVendor Advisory
- fortiguard.com/psirt/FG-IR-22-377 MitigationVendor Advisory
- packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProx… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authenticat… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProx… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authenticat… ExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% percentile: 100 · as of 2 November 2026
- CWE
- CWE-287