Is CVE-2022-42475 (Fortinet FortiOS Heap-Based Buffer Overflow) being exploited in the wild?

Yes. CISA added CVE-2022-42475 to its Known Exploited Vulnerabilities catalogue on 13 December 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

What “being exploited in the wild” means for this CVE

For a vulnerability like CVE-2022-42475, the practical question is not just whether a proof of concept exists, but whether real attackers are actively using it against exposed FortiOS SSL-VPN services. Once exploitation is confirmed, the issue moves from routine patch planning to urgent exposure reduction, because unauthenticated remote code execution can become immediate perimeter compromise.

That distinction matters because internet-facing SSL-VPN appliances are often high-value entry points. When a memory corruption flaw is being used operationally, defenders should treat every reachable instance as a likely target, not a hypothetical one, and assume automated scanning, opportunistic exploitation, and follow-on intrusion attempts may already be underway.

For a broader pattern of how actively exploited vulnerabilities are handled in practice, see Zero-Day and Exploited Vulnerabilities Guide, which covers emergency mitigation and post-patch hunting.

Why FortiOS SSL-VPN exposure is especially dangerous

A heap-based buffer overflow in a remote-facing VPN service is dangerous because it can collapse the normal trust boundary before any user authentication workflow meaningfully helps. If the vulnerable service is reachable from the internet, the attacker’s only prerequisite may be network access and a correctly shaped request, which makes mass exploitation feasible and reduces the warning time available to defenders.

This is why appliance-class vulnerabilities often create outsized risk compared with ordinary application bugs. The affected system is frequently both a security control and a production dependency, so compromise can expose credentials, tunnel traffic, configuration data, and a path into internal networks. For edge-device hardening and exposure reduction, the Edge Device Security Guide is the most relevant operational reference in the NHIMG corpus.

Because the direct answer already confirms CISA KEV listing and ransomware linkage, the remaining operational takeaway is simple: treat the appliance as a potential foothold for both initial access and later persistence, not just as a patching task.

What defenders should do while exploitation is ongoing

The first step is to confirm whether any FortiOS SSL-VPN instances are internet reachable, whether they are within the affected product footprint, and whether any adjacent management interfaces or administrative paths are also exposed. If patching or mitigation must wait, reduce exposure immediately by restricting access, segmenting management planes, and removing unnecessary external reachability.

Validate whether the appliance is still in service and externally accessible.
Apply the vendor’s fixed release or mitigation path as directed in the advisory.
If you cannot patch immediately, narrow inbound access to the smallest possible source set.
Check logs and telemetry for suspicious VPN requests, new accounts, configuration changes, or unusual post-authentication activity.
Review whether any credentials, sessions, or administrative tokens may have been exposed if the appliance was reachable during the exploitation window.

For incident handling, use the CISA Known Exploited Vulnerabilities Catalog as the authoritative operational trigger, and the NIST National Vulnerability Database for record-level vulnerability reference.

Risk and Threat Considerations

When a perimeter VPN flaw is confirmed in active exploitation, the main risk is not just code execution, it is loss of boundary control. Attackers can use the appliance as an entry point, then pivot toward internal services, harvest credentials, or establish persistence in a location defenders often trust too much.

Failure mechanism: A remotely reachable memory corruption flaw in an appliance can be exercised before authentication or with minimal interaction, allowing an attacker to execute code, alter device behaviour, or use the device as an internal launch point.

Impact: The likely consequences are perimeter compromise, internal network exposure, unauthorized access paths, and a materially higher chance of follow-on intrusion if the appliance handled privileged sessions or sensitive traffic.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Physical devices and systems are inventoried	Inventory exposed FortiOS appliances to confirm attack surface.
	PR.PS-01 — Configurations are managed and maintained to meet cybersecurity requirements	Exploitability hinges on prompt hardening and configuration control.
	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Active exploitation requires monitoring for suspicious VPN activity and post-exploit signals.
Recommendation — Inventory all internet-facing FortiOS appliances and track which ones are exposed to SSL-VPN traffic. Apply vendor mitigation and hardening changes to exposed FortiOS systems immediately. Monitor VPN logs and network telemetry for anomalous requests and follow-on access.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A KEV-listed exploited CVE requires urgent remediation and tracked exceptions.
	SI-4 — System Monitoring	Detection of exploitation depends on monitoring appliance and network activity.
Recommendation — Prioritize rapid remediation for the FortiOS vulnerability and document any exception. Correlate appliance, VPN, and network telemetry for signs of exploitation.

Practitioner Guidance

What to prioritise: Treat externally reachable FortiOS SSL-VPN systems as emergency assets. Patch or mitigate them before lower-risk internet-facing issues, and do not wait for visible compromise before acting.

What to verify: Confirm exposure, version alignment with the vendor advisory, and whether any logs show anomalous VPN requests, admin logins, or configuration changes during the exploitation window.

Decision rule: If the appliance was reachable from the internet while unpatched, assume compromise is plausible enough to justify hunt activity and credential review, even if you have not yet found a definitive indicator.

Practitioner takeaway: For KEV-listed perimeter flaws, the operational question is not whether exploitation is possible, but whether you can still defend the trust boundary fast enough to matter.