CVE-2022-40678: Fortinet Fortinac

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords.

Affected products

• Fortinet Fortinac: from 8.5.0, up to and including 8.5.4; from 8.6.0, up to and including 8.6.5; from 8.7.0, up to and including 8.7.6; from 8.8.0, up to and including 8.8.11; from 9.1.0, up to and including 9.1.7; from 9.2.0, up to and including 9.2.5; …

Published 2023-02-16. Last modified 2026-06-17.