CVE-2022-22299: Fortinet FortiADC

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.2, FortiMail version 6.4.0 through 6.4.5, FortiMail version 7.0.0 through 7.0.2 may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments.

Affected products

• Fortinet FortiADC: from 6.0.0, up to and including 6.0.4; from 6.1.0, up to and including 6.1.6; version 6.2.0 only; version 6.2.1 only
• Fortinet FortiMail: from 6.4.0, up to and including 6.4.5; from 7.0.0, up to and including 7.0.2
• Fortinet FortiOS: from 5.0.0, up to and including 5.0.14; from 5.2.0, up to and including 5.2.15; from 5.4.0, up to and including 5.4.13; from 5.6.0, up to and including 5.6.14; from 6.0.0, up to and including 6.0.14; from 6.2.0, up to and including 6.2.10; …
• Fortinet FortiProxy: from 1.0.0, up to and including 1.0.7; from 1.1.0, up to and including 1.1.6; from 1.2.0, up to and including 1.2.13; from 2.0.0, up to and including 2.0.7; version 7.0.0 only; version 7.0.1 only

Published 2022-08-05. Last modified 2026-06-17.