FortiOS SSL-VPN CVE-2022-42475
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | Critical risk (CVSS 9.8, EPSS 94%). FortiGate firewalls protect millions of networks worldwide. A pre-authentication RCE on the VPN portal gives attackers immediate access to the network perimeter device with root privileges. Mandiant attributed exploitation to UNC3886 (suspected Chinese). |
| Exploit ScenarioDerived | UNC3886 exploited the FortiOS zero-day to gain root access on FortiGate firewalls. They deployed custom implants (BOLDMOVE) designed specifically for FortiOS, disabled logging, and used the firewall's network position to intercept traffic and pivot into connected networks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
FortiOS SSL-VPN contains a heap-based buffer overflow allowing unauthenticated remote code execution, exploited as a zero-day from October 2022 by suspected Chinese state-sponsored actors targeting government networks.
Earlier versions of this analysis (1)
A critical heap-based buffer overflow in FortiOS and FortiProxy SSL-VPN enables unauthenticated remote code execution. Exploited as a zero-day since October 2022, with Fortinet confirming active exploitation in their December 2022 advisory.
RemediationAI
Upgrade FortiOS immediately. Check for indicators of UNC3886/BOLDMOVE compromise. Review firewall logs for anomalies. Verify firmware integrity. Rotate all credentials accessible from the FortiGate.
Affected ProductsAI
FortiOS SSL-VPN 7.2.0 through 7.2.2 FortiOS SSL-VPN 7.0.0 through 7.0.8 FortiOS SSL-VPN 6.4.0 through 6.4.10 FortiOS SSL-VPN 6.2.0 through 6.2.11 FortiProxy SSL-VPN 7.2.0 through 7.2.1
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-122 heap overflow in the SSL-VPN's request processing allows crafted requests to overflow a heap buffer, enabling arbitrary code execution with root privileges on the FortiGate appliance. The exploit targets the SSL-VPN web portal component accessible to any remote user.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Executive ViewAI
Organizations using FortiOS SSL-VPN 7.2.0 face critical risk from CVE-2022-42475 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB