Vulnerability intelligence

CVE-2022-42475

Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

CVSS Score

9.3

Critical

EPSS — Exploit Probability

—

Awaiting FIRST.org data

Exploitation

Confirmed in the wild

Used in ransomware campaigns

Remediation

unknown

Federal deadline 2023-01-03

CISA required action

Apply updates per vendor instructions. Deadline for federal agencies: 2023-01-03.

NVD entry PoC / advisory CISA KEV

1 article across 1 outlet · first covered Sep 15, 2026 · latest Sep 15, 2026

Coverage timeline

Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BB
www.securityweek.com · Sep 15, 2026

Related CVEs — Fortinet

CVE-2018-13379KEV CVE-2023-27997KEV CVE-2024-21762KEV CVE-2025-25249KEV CVE-2026-26084 CVE-2026-84393 CVE-2024-55591KEV CVE-2026-26035