CVE-2022-39952

9.8 criticalEPSS 100%

Critical (9.8) in fortinet fortinac. EPSS 100% chance of exploitation in the next 30 days.

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWEs: CWE-668, CWE-73
Published: 2023-02-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortinac

References

https://fortiguard.com/psirt/FG-IR-22-300
https://fortiguard.com/psirt/FG-IR-22-300

Check your stack JSON