Article
Two Fortinet events of 2026: what to check
Fortinet had two 2026 events: a January SSO login flaw and a June wave of leaked logins. See what a firewall owner checks, from…
Read more
Exploited vulnerability
FortiOS SSL-VPN heap overflow (CVE-2022-42475)
CVE-2022-42475
CVE-2022-42475 is a heap-based buffer overflow in the FortiOS SSL-VPN service.
- On CISA KEV
- CVE ID
- CVE-2022-42475
- CISA KEV
- Listed
- Affected product
- FortiOS SSL-VPN and FortiProxy SSL-VPN
- Exploited
- Yes
- Published
- December 2022
In short
CVE-2022-42475 is a heap-based buffer overflow in the FortiOS SSL-VPN service. Fortinet says a remote attacker with no login may run code or commands through crafted requests. Fortinet was aware of exploitation when it published the advisory in December 2022.
- CVECVE-2022-42475
- ProductFortinet FortiOS SSL-VPN and FortiProxy SSL-VPN
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade FortiOS · Check for persistent malware
What it allows
A remote attacker who has no account can send specially crafted requests to the SSL-VPN service and execute arbitrary code or commands on the firewall. A heap overflow means the software writes more data than a block of memory can hold, which can let an attacker take control of the device.
Who is affected
Fortinet lists FortiOS 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11 and 6.0.0 to 6.0.15, and all versions of the 5.6, 5.4, 5.2 and 5.0 branches. The National Vulnerability Database also lists FortiProxy SSL-VPN 7.2.0 to 7.2.1 and 7.0.7 and earlier.
Fortinet published its advisory on 12 December 2022 and said it was aware of an instance of exploitation in the wild. It listed crash log entries and file system artifacts for defenders to check. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 13 December 2022.
In an advisory first published on 7 February 2024, CISA and partner agencies said Volt Typhoon actors likely gained initial access in one confirmed compromise by exploiting this flaw on an unpatched FortiGate firewall, and compromised a domain admin account stored on the device. The advisory is attributed to CISA and its partners, 7 February 2024.
On 6 February 2024 the Dutch National Cyber Security Centre said the Dutch military and general intelligence services had found new malware on FortiGate devices. The initial access was gained by abusing CVE-2022-42475. The catalog marks known ransomware campaign use as Known.
Who exploits it
- Threat group UNC3886 Singapore's cyber agency (CSA) calls UNC3886 a state-sponsored group without naming a state, and MITRE ATT&CK describes it as China-nexus, in entries dated 2025 and 2026. Since at least late 2021
- Threat group Volt Typhoon Attributed by the US government and its Five Eyes partners to a People's Republic of China state-sponsored actor, Volt Typhoon is described in US advisories as pre-positioning inside critical infrastructure IT networks to be able to disrupt operations in a crisis. China · Since 2021
Seen in
What to do
-
Upgrade FortiOS
Fortinet names the fixed releases: 7.2.3, 7.0.9, 6.4.11, 6.2.12 and 6.0.16, or later. For the 5.x branches it says to migrate to a fixed release.
-
Check the indicators Fortinet lists
Look for repeated log entries showing the SSL VPN service crashing, and for the files named in the Fortinet advisory. Fortinet recommends validating systems immediately.
-
Assume stored credentials may be exposed
CISA reported a domain admin account stored on a compromised device. Rotate credentials kept on or reachable from the firewall.
-
Check for persistent malware
Dutch services found a remote access trojan built for FortiGate to keep access. Patching alone does not remove it, so inspect devices that ran vulnerable versions.
Questions
What is CVE-2022-42475?
CVE-2022-42475 is a heap-based buffer overflow in the FortiOS SSL-VPN service. A remote attacker with no account can send crafted requests and run code or commands on the firewall.
Which FortiOS versions are affected by CVE-2022-42475?
Fortinet lists FortiOS 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11 and 6.0.0 to 6.0.15, plus all versions of the 5.6, 5.4, 5.2 and 5.0 branches.
Was CVE-2022-42475 exploited in real attacks?
Yes. Fortinet said it was aware of exploitation when it published its advisory on 12 December 2022, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 13 December 2022.
Which threat groups used CVE-2022-42475?
CISA and partner agencies said Volt Typhoon actors likely gained initial access in one confirmed compromise through this flaw on an unpatched FortiGate firewall. The Dutch NCSC also reported initial access through it in February 2024.
In our research
- Two Fortinet events of 2026: what to check October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- UNC3886 Threat group
Sources
- FG-IR-22-398 Heap-based buffer overflow in sslvpnd Fortinet PSIRT
- NVD entry CVE-2022-42475 NIST National Vulnerability Database
- Known Exploited Vulnerabilities catalog CISA
- PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A) CISA, FBI, NSA and partners
- Nieuwe malware benadrukt aanhoudende interesse in edge devices Nationaal Cyber Security Centrum (NCSC-NL)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.