CVE-2022-38380: Fortinet FortiOS

Medium severity, CVSS 4.3. EPSS: 23% chance of exploitation in the next 30 days.

An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API.

Affected products

• Fortinet FortiOS: from 7.0.0, up to and including 7.0.7; version 7.2.0 only

Published 2022-11-02. Last modified 2026-06-17.