← Vulnerability Intelligence

CVE-2022-42475

Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
99% (percentile: 100) as of 2 November 2026
CWE
CWE-197, CWE-787

Affected products

fortinet: fortios; fortinet: fortiproxy; fortinet: fim-7901e; fortinet: fim-7904e; fortinet: fim-7910e; fortinet: fim-7920e; fortinet: fim-7921f; fortinet: fim-7941f; fortinet: fortigate-6300f; fortinet: fortigate-6300f-dc; fortinet: fortigate-6500f; fortinet: fortigate-6500f-dc; fortinet: fortigate-6501f; fortinet: fortigate-6501f-dc; fortinet: fortigate-6601f

References