Is CVE-2022-41328 (Fortinet FortiOS Path Traversal) being exploited in the wild?

What being added to KEV means for CVE-2022-41328

For this CVE, the operational signal matters more than the vulnerability label alone. CISA’s KEV listing means it has credible evidence of active exploitation, so defenders should treat it as a live exposure rather than a theoretical issue. The practical question is whether any FortiOS instance, especially one with exposed management access, is still reachable and unverified.

If you are tracking exploited appliance flaws, use a Zero-Day and Exploited Vulnerabilities Guide style workflow for triage: confirm exposure, verify the affected asset is in scope, and assume attacker interest is justified once KEV inclusion exists. For edge devices and management-plane weaknesses, the right first move is to narrow the attack surface before debating exploit details.

Why this FortiOS flaw is operationally sensitive

The flaw is a path traversal issue in FortiOS that may let a local privileged attacker read or write files through crafted CLI commands. On an appliance, that matters because file access can become configuration tampering, credential exposure, or persistence if management boundaries are weak. The problem is not just execution, it is that trusted administrative paths can be abused to reach sensitive data or change device state.

That is why appliance security guidance for management interfaces is relevant. The Edge Device Security Guide aligns with the kind of control this issue demands: harden the management plane, limit administrative exposure, and keep logging and patch discipline strong enough to spot abuse early. Appliance vulnerabilities are often exploited through the path defenders assume is “internal only.”

Because the issue is fundamentally about an appliance file-access weakness, the attack path is usually about privilege plus reachability, not just the presence of the CVE. If a privileged operator account, admin session, or management interface is overly exposed, the exploitability window becomes much larger than the product bulletin alone suggests.

How to respond when patching or maintenance must wait

The immediate response is to reduce the conditions that make exploitation practical. Restrict who can reach the FortiOS management plane, verify that only expected administrative accounts can issue privileged CLI actions, and review whether the device is exposed in a way that would let an attacker reuse valid access. Where patching is delayed, compensating controls should focus on containment, not convenience.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation timing and product details, then pair that with exploit-likely prioritisation from the FIRST EPSS signal when you are deciding what to handle first. If you cannot patch immediately, isolate the device, constrain administrative access, and preserve logs so you can investigate later without losing evidence.

Risk and Threat Considerations

KEV inclusion indicates the flaw is not merely present, it is attractive enough to be used. For a FortiOS appliance, that raises both exposure risk and persistence risk, because an attacker who reaches privileged management functions may be able to alter files, interfere with configuration, or plant footholds that survive routine user-side resets.

Failure mechanism: A privileged attacker abuses crafted CLI input to traverse file paths and reach data or writable locations that should be outside the intended management boundary. That can turn an administrative interface into a file-disclosure or file-modification path, especially where appliance hardening, access controls, or logging are weak.

Impact: Expect possible configuration tampering, credential or key exposure, and device-level compromise conditions that can support follow-on intrusion. On perimeter appliances, that can create a broad trust breach because the device may sit on a high-value network boundary and mediate multiple internal services.

Practitioner Guidance

What to verify: Confirm whether any FortiOS instance is internet reachable, management reachable from user networks, or administratively accessible to more accounts than necessary. Then verify whether your logs can show privileged CLI activity, configuration changes, and file-access anomalies around the KEV date and any later maintenance windows.

Decision rule: If the device is exposed and cannot be patched immediately, treat the case as an active containment problem, not a deferred patch ticket. Remove unnecessary management access first, then check for signs of configuration drift or unauthorized administrative use before assuming the system is clean.

Practitioner takeaway: For a KEV-listed appliance flaw, the real question is whether privileged access and management exposure were already too broad. If yes, assume the blast radius may be larger than the CVE description suggests and investigate for abuse before normal operations resume.

Related resources from NHI Mgmt Group

• Is CVE-2018-13379 (Fortinet FortiOS SSL VPN Path Traversal) being exploited in the wild?
• How do you patch or mitigate CVE-2022-41328 (Fortinet FortiOS Path Traversal)?
• CVE-2022-41328 (Fortinet FortiOS Path Traversal)
• Is CVE-2022-42475 (Fortinet FortiOS Heap-Based Buffer Overflow) being exploited in the wild?