CVE-2022-40684 is an authentication bypass vulnerability in Fortinet Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalogue on 11 October 2022, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What the vulnerability means in practice
CVE-2022-40684 is dangerous because it breaks the normal trust boundary around authentication. In products that handle administrative access, an authentication bypass can let an attacker reach privileged functions without proving who they are, which turns a single exposed service into a high-impact entry point.
For organisations, the key question is not whether the issue exists in the abstract, but whether any internet-reachable or internally exposed Fortinet instance is still running the vulnerable code path. A weakness of this kind can be abused quickly once it becomes public, so exposure management matters as much as patching.
How organisations assess exposure
Start with asset inventory and product discovery, then confirm which Fortinet instances are deployed, where they sit in the network, and whether they are reachable from the internet or from user-accessible segments. Vendor advisories and the CVE Program help anchor the exact issue, while the NIST National Vulnerability Database is a useful cross-check for record details and references.
Because CISA placed this CVE in the Known Exploited Vulnerabilities catalogue, exposure review should be treated as urgent rather than routine. Where patch status is unclear, organisations should assume that externally exposed systems deserve immediate investigation and prioritised handling.
Remediation and compensating controls
The preferred response is the vendor fix or mitigation identified for the exact product and deployment. Until that can be applied, reduce exposure by narrowing access paths, removing public reachability where possible, and placing strong administrative controls around any management interfaces that remain online.
If the device or service cannot be patched immediately, compensating controls should focus on containment rather than hope. That usually means restricting trusted management networks, reviewing remote administration paths, and ensuring monitoring is in place for any login events or configuration changes that should not be possible on a properly protected system.
Detection and post-exploitation review
An authentication bypass is often most dangerous when it is used for quiet follow-on access, not just the initial login event. After remediation, organisations should review logs, administrative changes, unexpected configuration edits, and any signs that the appliance or adjacent systems were used to move deeper into the environment.
Where compromise is suspected, the investigation should extend beyond the product itself. Validate whether attacker access may have exposed sessions, credentials, API tokens, or privileged accounts that were reachable from the affected system, and confirm whether any downstream systems show signs of reuse or lateral movement.
Risk and Threat Considerations
This vulnerability is especially risky because it can collapse a front-door control into an unauthenticated entry path. Once a privileged interface is bypassed, attackers may be able to alter configuration, intercept traffic, or pivot into adjacent systems that trusted the device or service.
Failure mechanism: The attacker abuses the authentication flaw to obtain administrative access without valid credentials, then uses that access to change controls, harvest secrets, or create persistence.
Impact: The result can include device takeover, exposure of sensitive network traffic, broader compromise of connected systems, and a much harder remediation effort if the attacker has already modified configuration or access paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Authentication bypass directly undermines user authentication controls on administrative access. |
| SI-2 — Flaw Remediation | This CVE is a remediable flaw requiring rapid fix and mitigation management. | |
| AC-3 — Access Enforcement | The vulnerability defeats access enforcement at the management boundary. | |
| Recommendation — Enforce strong user authentication for administrative access and block any bypass path that reaches privileged functions. Prioritise remediation for the affected Fortinet product and verify mitigation is fully applied. Verify that access enforcement still blocks unauthenticated requests to management interfaces. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | CVE-2022-40684 requires discovery, prioritisation, remediation and verification as part of vulnerability management. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Compensating controls depend on hardened management exposure and safe configuration. | |
| Recommendation — Inventory exposed Fortinet assets and accelerate remediation of the KEV-listed flaw. Harden management access paths and remove unnecessary exposure until the fix is in place. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | The vulnerability is an authentication-bypass issue affecting access control enforcement. |
| ID.RA-01 — Asset Vulnerability Identification and Analysis | Exposure assessment depends on identifying vulnerable Fortinet assets and their reachability. | |
| Recommendation — Validate that authentication and access control still govern all administrative paths. Identify every deployed Fortinet instance and assess which ones are exposed to attack. | ||
Practitioner Guidance
Why practitioners should care: KEV-listed authentication bypasses belong at the top of the remediation queue because they are already known to be weaponised in the wild. Treat the issue as an exposure management problem, not just a software maintenance task.
What to watch for: Pay close attention to any Fortinet estate where ownership is unclear, patch status is stale, or management access is exposed beyond a tightly controlled admin network. Those are the systems most likely to remain vulnerable long enough to be targeted.
Practitioner takeaway: If you cannot prove the device is fixed, protected, and monitored, you should assume it remains a live attack surface.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org