CVE-2022-23438: Fortinet FortiOS

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and prior may allow an unauthenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the captive portal authentication replacement page.

Affected products

• Fortinet FortiOS: up to and including 6.4.9; from 7.0.0, up to and including 7.0.5

Published 2022-07-18. Last modified 2026-06-17.