CVE-2022-35843: Fortinet FortiOS

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server.

Affected products

• Fortinet FortiOS: from 6.0.0, up to and including 6.0.15; from 6.2.0, up to and including 6.2.12; from 6.4.0, up to and including 6.4.9; from 7.0.0, up to and including 7.0.7; version 7.2.0 only; version 7.2.1 only
• Fortinet FortiProxy: from 1.2.0, up to and including 1.2.13; from 2.0.0, up to and including 2.0.10; from 7.0.0, up to and including 7.0.6

Published 2022-12-06. Last modified 2026-06-17.