CVE-2022-39952: Fortinet FortiNAC unauthenticated remote code execution
The short version: Fortinet FortiNAC — the network access-control appliance — has a flaw (CVE-2022-39952) that gives an unauthenticated attacker control over a file name/path, leading to code execution on the device. It scores 9.8 and a working exploit went public shortly after disclosure. It isn't in CISA's KEV catalog, but with a 9.8 and a public PoC it's a patch-now item. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — 9.8 with a public exploit, though not KEV-listed (see below) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.82% · 99.96th percentile (2026-07-17) |
| In CISA KEV? | No — not listed at time of writing |
| Known exploited? | Public exploit code released shortly after disclosure; internet-wide exploitation attempts reported. Confirmed in-the-wild campaigns: Unknown at time of writing |
| Vulnerability type | CWE-73 external control of file name or path → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | FortiNAC 8.3.7; 8.5.x; 8.6.x; 8.7.x; 8.8.x; 9.1.0–9.1.7; 9.2.0–9.2.5; 9.4.0 |
| Fixed in | FortiNAC 9.4.1 · 9.2.6 · 9.1.8 · 7.2.0 and later |
What you need to know
CVE-2022-39952 is an external-control-of-filename/path flaw in FortiNAC. An unauthenticated attacker sends a crafted HTTP request that lets them control where a file is written on the appliance, and that primitive is turned into arbitrary code execution.
- How they find it — internet-wide scanning surfaces exposed FortiNAC management interfaces.
- How they use it — a public proof-of-concept made writing an attacker-controlled file (for example, a scheduled task) and executing code straightforward.
- What it leads to — code execution on an appliance that governs network access, a strong pivot point into the environment.
How serious we see it
Critical — a 9.8 with a public exploit, held just short of our top tier because it isn't KEV-listed.
The mechanics are as bad as they get on paper: unauthenticated RCE on an internet-facing management appliance, with a ready-made exploit. We rate it High rather than Critical because, unlike the KEV-listed Fortinet flaws in this series, we don't have authoritative confirmation of widespread in-the-wild campaigns — but a public PoC against a 9.8 is not a gap you leave open. The reassuring, bounded part: it affects specific FortiNAC versions, the fixes are published, and exposure is quick to determine.
Recommendations
Straight from Fortinet's advisory (FG-IR-22-300):
- Patch now. Upgrade to FortiNAC 9.4.1 / 9.2.6 / 9.1.8 / 7.2.0 or later.
- Get the management interface off the public internet. Restrict FortiNAC administration to trusted networks.
- Hunt for prior use. Given the public exploit, check for unexpected files, scheduled tasks, and webshells on the appliance.
- If you find indicators, respond fully. Rebuild and rotate credentials, keys, and certificates.
- Confirm your exposure first. Verify whether any FortiNAC interface is reachable from the internet and on an affected build.
How BreachRisk sees it
BreachRisk discovers internet-facing FortiNAC interfaces from little more than your domain, fingerprints the version, and flags exposure against known-affected builds. Where authorized, it goes beyond detection and safely performs a bounded, non-disruptive check against the affected endpoint to confirm it responds as a vulnerable instance would, rather than flagging a maybe.
That outside-in view matters most for a flaw like this — a serious bug with a public exploit but no KEV deadline forcing the issue. Having the exposed appliance mapped and ranked means it doesn't quietly sit unpatched just because a regulator hasn't put a date on it.