Fortinet reiterates call to mitigate against active zero-day, as customers delay fixes

The Fortinet logo on a phone, with blue binary code in the background

Fortinet has issued an urgent warning to customers advising once again to update devices against a zero-day vulnerability that has been exploited at least once in the wild.

FortiOS, FortiProxy, and FortiSwitchManager are all affected by the zero-day, an authentication bypass flaw which allows threat actors to run operations on a device’s administrative interface. Tracked as CVE-2022-40684, the vulnerability carries a CVSS score of 9.6, and is therefore considered critical.


Facilitating Fintech

Reducing the risk of potential data interception among fintech solutions


Before going public with the zero-day on October 10, Fortinet privately contacted the owners of potentially affected devices on October 6, with a list of recommended mitigations. However, the company has said that, at the time of writing, many devices have still not been updated or had mitigations applied, leaving a large number of customers at risk of cyber attacks and opening networks to threats such as malware, ransomware, and data breaches.

FortiProxy OS versions 7.0.0 to 7.2.1 are affected by the flaw, along with FortiProxy versions 7.0.0 to 7.2.0, and FortiSwitchManager 7.0.0 and 7.2.0. In response, the company has released a number of updates, as well as manual workarounds for the three affected services.

“After multiple notifications from Fortinet over the past week, there are still a significant number of devices that require mitigation, and following the publication by an outside party of POC code, there is active exploitation of this vulnerability,” reads Fortinet’s blog post on the update.

“Based on this development, Fortinet again recommends customers and partners take urgent and immediate action as described in the public Advisory.”

The exploit has now been added to the Cybersecurity and Infrastructure Security Agency’s (CISA) ‘known vulnerabilities’ catalogue, which is regularly updated with threats that the agency considers an active threat to federal operations. As a result of being added to the list, federal agencies have until November 1 to patch all Fortinet equipment and apply appropriate mitigations.

“This is a critical vulnerability,” stated Avishai Avivi, CISO at SafeBreach.

“It basically allows the malicious actor to take control of the organisation’s firewall. We join Fortinet in their recommendation. With this being a zero-day vulnerability, we also strongly recommend that organisations take steps to validate their firewall configuration.

"If an attacker manages to take control of the firewall, they can modify the firewall configuration to remove protection, add potential vectors for the attacker to use, and even add users. This is also an important reminder that companies should always keep a backup copy of their firewall configuration files.”

Rory Bathgate
Features and Multimedia Editor

Rory Bathgate is Features and Multimedia Editor at ITPro, overseeing all in-depth content and case studies. He can also be found co-hosting the ITPro Podcast with Jane McCallion, swapping a keyboard for a microphone to discuss the latest learnings with thought leaders from across the tech sector.

In his free time, Rory enjoys photography, video editing, and good science fiction. After graduating from the University of Kent with a BA in English and American Literature, Rory undertook an MA in Eighteenth-Century Studies at King’s College London. He joined ITPro in 2022 as a graduate, following four years in student journalism. You can contact Rory at or on LinkedIn.