CVE-2022-23439: Fortinet FortiADC

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Affected products

• Fortinet FortiADC: from 5.4.0, before 6.2.4 (fixed in 6.2.4)
• Fortinet Fortiauthenticator: from 6.3.0, before 6.3.4 (fixed in 6.3.4); from 6.4.0, before 6.4.2 (fixed in 6.4.2)
• Fortinet Fortiddos: from 5.3.0, before 5.5.2 (fixed in 5.5.2)
• Fortinet Fortiddos-F: from 6.1.0, before 6.3.4 (fixed in 6.3.4)
• Fortinet FortiMail: from 6.4.0, before 7.0.4 (fixed in 7.0.4)
• Fortinet Fortindr: from 1.4.0, before 7.1.1 (fixed in 7.1.1); version 7.2.0 only
• Fortinet FortiOS: from 6.0.0, before 7.0.6 (fixed in 7.0.6); from 7.2.0, before 7.2.5 (fixed in 7.2.5)
• Fortinet FortiProxy: from 2.0.0, before 7.0.5 (fixed in 7.0.5); from 7.2.0, before 7.4.0 (fixed in 7.4.0)
• Fortinet Fortirecorder: from 6.0.0, before 6.0.11 (fixed in 6.0.11); from 6.4.0, before 6.4.3 (fixed in 6.4.3)
• Fortinet Fortisoar: from 6.4.0, before 7.3.0 (fixed in 7.3.0)
• Fortinet Fortiswitch: from 6.4.0, before 7.0.5 (fixed in 7.0.5)
• Fortinet Fortitester: from 3.7.0, before 7.2.2 (fixed in 7.2.2)
• Fortinet Fortivoice: from 6.0.0, before 6.4.9 (fixed in 6.4.9)
• Fortinet Fortiwlc: from 8.6.0, before 8.6.7 (fixed in 8.6.7)

Published 2025-01-22. Last modified 2026-06-17.