CVE-2022-42475: Fortinet FortiOS SSL-VPN heap overflow, unauthenticated RCE exploited as a zero-day
The short version: FortiOS's SSL-VPN has a heap-based buffer overflow (CVE-2022-42475) that lets an unauthenticated attacker execute arbitrary code on the device via crafted requests. It scores 9.8, it's in CISA's KEV catalog, and it was exploited as a zero-day before the patch — and reused in later post-exploitation activity. If you run an affected SSL-VPN build, patch and hunt. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.47% · 99.94th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-01-03 |
| Known exploited? | Yes — exploited as a zero-day before the fix; reused in later post-exploitation activity |
| Vulnerability type | CWE-787 out-of-bounds write (heap overflow) → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | FortiOS SSL-VPN across 6.0–7.2.2 (and earlier 5.x); FortiProxy SSL-VPN 7.0.0–7.0.7, 7.2.0–7.2.1 (see advisory for the full matrix) |
| Fixed in | FortiOS 7.2.3 · 7.0.9 · 6.4.11 · 6.2.12 · 6.0.16 · FortiProxy 7.2.2 · 7.0.8 · 2.0.12 and later |
What you need to know
CVE-2022-42475 is a heap-based buffer overflow in the FortiOS SSL-VPN. A remote, unauthenticated attacker who sends specially crafted requests can corrupt memory and achieve arbitrary code execution on the appliance.
- It's the remote-access edge. Code execution on the SSL-VPN gateway is a foothold into the network it protects, not a contained problem.
- It's pre-authentication and network-reachable — SSL-VPN portals are meant to be internet-facing.
- It was live before the fix. Fortinet and researchers documented in-the-wild exploitation as a zero-day, and the flaw has featured in later post-exploitation activity (including symlink-persistence techniques observed in 2025) — so an affected appliance may have been touched pre-patch.
How serious we see it
Critical — the 9.8 is earned here.
Unauthenticated, network-reachable code execution on an internet-facing VPN gateway, confirmed exploited as a zero-day, is exactly the profile that belongs at the top of the queue. The bounded, reassuring part: it affects specific FortiOS and FortiProxy SSL-VPN builds, the fixes are published across all supported branches, and exposure is quick to determine. The catch is the pre-patch window — patched and clean are separate questions, so hunting matters here.
Recommendations
Straight from Fortinet's advisory (FG-IR-22-398) and CISA:
- Patch now. Upgrade to FortiOS 7.2.3 / 7.0.9 / 6.4.11 / 6.2.12 / 6.0.16 (or the matching FortiProxy builds) or later.
- Hunt for prior compromise. Follow Fortinet's IoC guidance; check for the artifacts and persistence associated with this campaign, given the zero-day window.
- If you find indicators, respond fully. Rebuild the appliance and rotate all credentials, keys, and certificates.
- Harden exposure. Restrict who can reach the SSL-VPN and keep the management interface off the public internet.
- Confirm your exposure first. Verify whether any internet-facing FortiGate SSL-VPN is on an affected build.
How BreachRisk sees it
BreachRisk discovers internet-facing FortiGate SSL-VPN portals from little more than your domain, fingerprints the FortiOS version, and flags exposure tied to KEV-listed, actively exploited flaws like this one — surfaced at the top of your results because it's in KEV. Where authorized, it goes beyond detection and safely performs a bounded, non-disruptive probe to gauge whether the endpoint behaves as an affected build would, rather than attempting the overflow itself.
That outside-in, continuous view is precisely for firewall zero-days like this one: the exposed appliance is already mapped and ranked, so you can go straight to patch-and-hunt.