One final verification practice completes the principle: quarterly, from an external vantage point, enumerate every administrative interface the organization exposes — not from the inventory, from the scan — and reconcile the two lists. The delta is the finding, and the finding is the genre in miniature: management planes that drifted to exposure between audits, attached to infrastructure whose privilege nobody disputed while its admin surface sat one password from the internet. The scan costs nothing, the reconciliation takes an hour, and the practice converts the management-plane principle from doctrine quoted in postmortems into a control measured in exceptions per quarter — the only form in which principles stay true.
Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
The management-plane principle in one paragraph
If an interface exists to administer infrastructure, it inherits the full privilege of the infrastructure it administers — and must therefore carry the full protection burden of that privilege. The principle sounds obvious and was violated everywhere: management planes exposed to the internet behind passwords, patched on hardware cycles, monitored by nobody, holding the keys to everything they manage. This vulnerability class kept succeeding because the principle kept losing to convenience, and the sector correction — management networks, jump hosts, tier-0 authentication on consoles — is the discipline this entry exists to reinforce: the next audit question is always the same, and it is never about the CVE number. What does your administrative surface look like from the internet, and why?
Quick Answer — In October 2022, Fortinet warned customers that CVE-2022-40684, an authentication bypass in FortiOS and FortiProxy administrative interfaces, was being exploited in the wild (CVSS 9.8). By sending a crafted HTTPS request, an attacker could add their own SSH key to admin accounts — no password stolen, no session hijacked, just a new key quietly authorized. Mass scanning began almost immediately, and honeypots filled with attempts within days. The lesson: anything that can mint admin access must never be internet-facing, and management planes belong behind VPN or allowlists, not on the public firewall itself. (Note: this article covers a security event; see web vulnerability primers for background.)
What happened
Per Fortinet’s PSIRT advisory and contemporaneous threat reporting:
- The bug. An alternate-path authentication weakness in the admin web interface: crafted requests could reach privileged operations without valid credentials. Fortinet rated it critical, CVSS 9.8.
- The proof. Fortinet’s advisory shipped with an IOC list: attacker-created usernames and SSH key names observed in real incidents, plus the request shapes captured by honeypot and sensor networks. Defenders could grep for the rogue accounts the moment the advisory landed.
- The exploitation window. The advisory shipped October 10, 2022 with a note that exploitation had been observed; mass-internet scanning followed within days, per GreyNoise and other sensor networks. By late October, CISA added the CVE to its KEV catalog and, in November, issued an emergency directive requiring federal agencies to patch.
- The fix. Nothing clever: patch to the fixed FortiOS/FortiProxy builds, and (standard guidance) keep admin interfaces off the public internet altogether.
Impact and numbers
| Metric | Value |
|---|---|
| CVE | CVE-2022-40684 |
| Severity | Critical — CVSS 9.8 |
| Products | FortiOS, FortiProxy, FortiWebManager |
| Attack surface | Administrative HTTPS interface (management plane) |
| Effect | Unauthenticated attacker adds SSH keys / creates admin accounts |
| Exploitation | Observed in the wild at disclosure (Fortinet PSIRT); mass scanning within days |
| Response | CISA KEV listing; November 2022 emergency directive for federal agencies |
Why management-plane exposure is the whole game
The bug’s severity came less from the request-forging itself than from what the management plane can do: mint credentials, alter policy, and persist. A network perimeter device whose admin interface answers to the internet is a dagger pointing inward — whoever owns that interface owns the network’s rules. That’s why the universal hardening rule (management access via out-of-band network or VPN-only) predates this CVE by decades, and why every post-incident writeup of exploited edge-device bugs lists “management plane exposed” as the amplifying condition. The 2022 wave of edge-device zero-days — FortiOS here, ProxyNotShell in Exchange, and others — convinced many orgs to finally enforce it.
Timeline
| Date | Event |
|---|---|
| 2022-10-10 | Fortinet PSIRT advisory: CVE-2022-40684 critical auth bypass, exploitation observed |
| 2022-10-10 onward | Patch rush; internet-wide scanning detected by sensor networks |
| 2022-10 | CISA adds CVE to KEV catalog |
| 2022-11 | CISA emergency directive: federal agencies must patch |
| 2022 → 2024 | Repeated exploitation campaigns; CVE remains a top IOC in edge-device incident reports |
Why it still matters in 2026
Because the pattern repeats annually: a critical auth bypass in an internet-facing edge device, exploited before most orgs finish reading the advisory. The 2026 defensive posture for edge devices is now standardized: management planes reachable only via VPN or dedicated management networks, enforced by allowlist; automated CVE-to-KEV-to-patch pipelines with SLAs measured in days; and deception tooling (honeypot admin interfaces) that turns mass scanning into free threat intelligence. Fortinet’s 2022 wave also seeded the now-common board question: “how many of our devices’ admin pages can I reach from my home broadband?” — and the acceptable answer is zero.
The bypass, in one diagram
attacker FortiOS admin HTTPS
| |
| crafted HTTPS request |
| (forge auth context) --->|
| |
| no password needed
| privileged op accepted
| |
|<--- SSH key added -------|
|<--- rogue admin minted --|
| |
defense: keep management
plane off the internet;
patch on advisory dayDetection and hardening takeaways
- Inventory your management planes. Every device with an admin web page gets a row: URL, exposure, auth method. Most orgs find forgotten ones during this exercise.
- VPN-only management. The single highest-value control from this entire bug class: if the admin interface cannot be routed from the internet, the auth bypass has no reach.
- Watch for new admin users and SSH keys. Both are creation events; alert on any change to admin roster outside change windows.
- Patch edge devices on advisory day. When the vendor says “exploited in the wild,” the clock is already at zero; the KEV listing will follow within days.
- Scan yourself like the attackers do. External attack-surface scans should flag any admin login page on public IPs — including the firewall’s own.
How were attacks actually detected?
Three ways, in practice. First, honeypots and sensor networks (GreyNoise-style) logged the scanning wave in near-real time, publishing the request shapes. Second, Fortinet’s IOCs — the rogue usernames and SSH key names seen in incidents — gave defenders exact patterns to grep. Third, alerting on new admin-account creation caught live compromises. The takeaway: for edge-device bugs, publish-and-search beats detect-from-first-principles; the IOCs are as valuable as the patch.
Who exploited it?
Mass opportunistic scanning dominated the volume, per sensor-network reporting. Fortinet’s advisory did not attribute the initial exploitation; threat-intel outlets later tied campaigns exploiting the CVE to multiple actors, including spambot-style botnet operators and, in some reporting, groups tracked to state-adjacent interests. Attribution for the first exploit remains unsettled — the honest summary is “opportunists first, everyone eventually,” which is why the patch SLA, not the attribution, is the control that matters.
What if I can’t patch immediately?
The documented mitigations: restrict management access to trusted IP ranges (immediately shrinking the attack surface), disable HTTP/HTTPS admin access from external interfaces where possible, and monitor aggressively for the IOC patterns (rogue users, unexpected SSH keys) until patched. But treat all of it as a bridge — the only durable fix is the upgraded firmware, and the exploitation window for delay is measured in days, not weeks.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
Management-plane RCE and the path-where-it-should-not-be
CVE-2022-40684 — Fortinet authentication bypass on management interfaces via crafted paths — extended the edge-appliance doctrine with its placement lesson: the vulnerability lived on the administrative plane, which converted the standard mitigation (management interfaces off the internet) from best practice into the difference between a patch event and a breach. Exploitation followed disclosure within days, at scale, targeting exposed management interfaces that asset inventories had missed in the usual proportion.
The doctrine items exercised, in the genre-standard sequence: exposure-first triage (which management planes face the internet — the question that decides the weekend), patch clocks proportional to privilege (administrative-plane RCE patches in hours, not cycles), and post-patch hunting (new local users and configuration changes — the rogue-admin pattern that edge-device intrusions reliably leave). The Fortinet guidance and subsequent advisories converged on the same runbook the genre had been writing since 2018-era campaigns, now with vendor-published detection artifacts attached.
The consolidation: the management-plane distinction became doctrine vocabulary — interfaces that exist to administer rather than serve belong behind the same controls as the console session they represent, network-restricted and authenticated at tier-0 strength. Every entry in the edge genre since has re-tested the same homework; the grading distribution across the sector has improved exactly as fast as inventories have, and not one deployment faster.
The post-incident Fortinet sector data added one more genre statistic worth recording: the population that patched within the first week — single-digit percentages of exposed instances, in the initial counts — rose steadily as exploitation reports accumulated, tracing the sector response curve in public telemetry. The curve, not the count, is the reusable finding: exposure-based urgency moves populations faster than severity-based urgency, and the advisory language that leads with your management interface is being scanned right now outperformed the language that led with the score. Genre doctrine, graded in telemetry, published free.
The scan, the reconciliation, the exceptions trend — three numbers per quarter, and the management-plane principle measured rather than believed. That is the closing form of every doctrine in this genre: a metric, an owner, and a trendline, because principles without telemetry are marketing, and the edge record prices the difference at incident scale, every year, without exception on record.
- Cisco BroadWorks CVE-2023-20237: The SSO Bypass Scare
- ConnectWise ScreenConnect Auth Bypass: An Instant RCE Wave
- FortiOS SSL-VPN Heap Overflow: Pre-Auth Emergency
