CVE-2022-45861: Fortinet FortiOS

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated attacker to crash the sslvpn daemon via an HTTP GET request.

Affected products

• Fortinet FortiOS: from 6.2.0, up to and including 6.2.13; from 6.4.0, up to and including 6.4.11; from 7.0.0, up to and including 7.0.9; from 7.2.0, up to and including 7.2.3
• Fortinet FortiProxy: from 1.2.0, up to and including 1.2.13; from 2.0.0, up to and including 2.0.11; from 7.0.0, up to and including 7.0.7; version 1.1.5 only; version 1.1.6 only; version 7.2.0 only; …

Published 2023-03-07. Last modified 2026-06-17.