Quick Answer — In October 2022, Fortinet warned customers that CVE-2022-40684, an authentication bypass in FortiOS and FortiProxy administrative interfaces, was being exploited in the wild (CVSS 9.8). By sending a crafted HTTPS request, an attacker could add their own SSH key to admin accounts — no password stolen, no session hijacked, just a new key quietly authorized. Mass scanning began almost immediately, and honeypots filled with attempts within days. The lesson: anything that can mint admin access must never be internet-facing, and management planes belong behind VPN or allowlists, not on the public firewall itself. (Note: this article covers a security event; see web vulnerability primers for background.)
What happened
Per Fortinet’s PSIRT advisory and contemporaneous threat reporting:
- The bug. An alternate-path authentication weakness in the admin web interface: crafted requests could reach privileged operations without valid credentials. Fortinet rated it critical, CVSS 9.8.
- The proof. Fortinet’s advisory shipped with an IOC list: attacker-created usernames and SSH key names observed in real incidents, plus the request shapes captured by honeypot and sensor networks. Defenders could grep for the rogue accounts the moment the advisory landed.
- The exploitation window. The advisory shipped October 10, 2022 with a note that exploitation had been observed; mass-internet scanning followed within days, per GreyNoise and other sensor networks. By late October, CISA added the CVE to its KEV catalog and, in November, issued an emergency directive requiring federal agencies to patch.
- The fix. Nothing clever: patch to the fixed FortiOS/FortiProxy builds, and (standard guidance) keep admin interfaces off the public internet altogether.
Impact and numbers
| Metric | Value |
|---|---|
| CVE | CVE-2022-40684 |
| Severity | Critical — CVSS 9.8 |
| Products | FortiOS, FortiProxy, FortiWebManager |
| Attack surface | Administrative HTTPS interface (management plane) |
| Effect | Unauthenticated attacker adds SSH keys / creates admin accounts |
| Exploitation | Observed in the wild at disclosure (Fortinet PSIRT); mass scanning within days |
| Response | CISA KEV listing; November 2022 emergency directive for federal agencies |
Why management-plane exposure is the whole game
The bug’s severity came less from the request-forging itself than from what the management plane can do: mint credentials, alter policy, and persist. A network perimeter device whose admin interface answers to the internet is a dagger pointing inward — whoever owns that interface owns the network’s rules. That’s why the universal hardening rule (management access via out-of-band network or VPN-only) predates this CVE by decades, and why every post-incident writeup of exploited edge-device bugs lists “management plane exposed” as the amplifying condition. The 2022 wave of edge-device zero-days — FortiOS here, ProxyNotShell in Exchange, and others — convinced many orgs to finally enforce it.
Timeline
| Date | Event |
|---|---|
| 2022-10-10 | Fortinet PSIRT advisory: CVE-2022-40684 critical auth bypass, exploitation observed |
| 2022-10-10 onward | Patch rush; internet-wide scanning detected by sensor networks |
| 2022-10 | CISA adds CVE to KEV catalog |
| 2022-11 | CISA emergency directive: federal agencies must patch |
| 2022 → 2024 | Repeated exploitation campaigns; CVE remains a top IOC in edge-device incident reports |
Why it still matters in 2026
Because the pattern repeats annually: a critical auth bypass in an internet-facing edge device, exploited before most orgs finish reading the advisory. The 2026 defensive posture for edge devices is now standardized: management planes reachable only via VPN or dedicated management networks, enforced by allowlist; automated CVE-to-KEV-to-patch pipelines with SLAs measured in days; and deception tooling (honeypot admin interfaces) that turns mass scanning into free threat intelligence. Fortinet’s 2022 wave also seeded the now-common board question: “how many of our devices’ admin pages can I reach from my home broadband?” — and the acceptable answer is zero.
The bypass, in one diagram
attacker FortiOS admin HTTPS
| |
| crafted HTTPS request |
| (forge auth context) --->|
| |
| no password needed
| privileged op accepted
| |
|<--- SSH key added -------|
|<--- rogue admin minted --|
| |
defense: keep management
plane off the internet;
patch on advisory dayDetection and hardening takeaways
- Inventory your management planes. Every device with an admin web page gets a row: URL, exposure, auth method. Most orgs find forgotten ones during this exercise.
- VPN-only management. The single highest-value control from this entire bug class: if the admin interface cannot be routed from the internet, the auth bypass has no reach.
- Watch for new admin users and SSH keys. Both are creation events; alert on any change to admin roster outside change windows.
- Patch edge devices on advisory day. When the vendor says “exploited in the wild,” the clock is already at zero; the KEV listing will follow within days.
- Scan yourself like the attackers do. External attack-surface scans should flag any admin login page on public IPs — including the firewall’s own.
How were attacks actually detected?
Three ways, in practice. First, honeypots and sensor networks (GreyNoise-style) logged the scanning wave in near-real time, publishing the request shapes. Second, Fortinet’s IOCs — the rogue usernames and SSH key names seen in incidents — gave defenders exact patterns to grep. Third, alerting on new admin-account creation caught live compromises. The takeaway: for edge-device bugs, publish-and-search beats detect-from-first-principles; the IOCs are as valuable as the patch.
Who exploited it?
Mass opportunistic scanning dominated the volume, per sensor-network reporting. Fortinet’s advisory did not attribute the initial exploitation; threat-intel outlets later tied campaigns exploiting the CVE to multiple actors, including spambot-style botnet operators and, in some reporting, groups tracked to state-adjacent interests. Attribution for the first exploit remains unsettled — the honest summary is “opportunists first, everyone eventually,” which is why the patch SLA, not the attribution, is the control that matters.
What if I can’t patch immediately?
The documented mitigations: restrict management access to trusted IP ranges (immediately shrinking the attack surface), disable HTTP/HTTPS admin access from external interfaces where possible, and monitor aggressively for the IOC patterns (rogue users, unexpected SSH keys) until patched. But treat all of it as a bridge — the only durable fix is the upgraded firmware, and the exploitation window for delay is measured in days, not weeks.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
