CVE-2022-39952: Fortinet Fortinac

Critical severity, CVSS 9.8. EPSS: 99.8% chance of exploitation in the next 30 days.

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.

Affected products

• Fortinet Fortinac: from 8.3.7, up to and including 8.8.9; from 9.1.0, before 9.1.8 (fixed in 9.1.8); from 9.2.0, before 9.2.6 (fixed in 9.2.6); from 9.4.0, before 9.4.1 (fixed in 9.4.1)

Published 2023-02-16. Last modified 2026-06-17.