CVE-2022-42475VulnerabilityPublished 12/13/2022Updated 10/24/2026
CVE-2022-42475: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Affects Fortinet FortiOSSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 12/13/2022
- KEV deadline
- 01/03/2023
- Ransomware
- Used in ransomware campaigns
- EPSS
- 99.5% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.