Would you have caught the Fortinet SSL VPN flaws? Test five things: do you know every edge device you run, do you hear about advisories the day they publish, can you patch the edge in days, can you disable a feature fast, and are logs stored off the device? Five yes answers means a good position.
What happened, briefly?
Two Fortinet advisories show the pattern. We are describing what Fortinet's own advisories say.
CVE-2022-42475 (FG-IR-22-398), published 12 December 2022. A heap based buffer overflow in the FortiOS SSL VPN daemon that a remote, unauthenticated attacker may use to run code or commands through crafted requests. CVSS v3 9.8. The workaround was to disable SSL VPN, and fixed versions were listed. The advisory includes indicators of compromise such as sslvpnd crash entries and specific filesystem artifacts. It says Fortinet is aware of one instance of exploitation, though the metadata field in the same advisory reads "No", an inconsistency worth knowing about.
CVE-2024-21762 (FG-IR-24-015), published 8 February 2024. An out of bounds write in FortiOS and FortiProxy that may let a remote, unauthenticated attacker run code or commands through crafted HTTP requests. CVSS v3 9.8. The workaround was again to disable SSL VPN, and the advisory states that disabling web mode is not a valid workaround. It says the flaw is potentially being exploited in the wild, while its own metadata field reads "No".
Both affected a service that faces the internet by design. Neither needed credentials.
The checklist
Score each item yes, partly or no. This is a test of process, not a judgment of anyone's effort. Edge devices are hard to run well.
1. Inventory. Do you have a current list of every internet facing device, including its model, software version and owner? Could you produce it in an hour?
2. Advisory intake. Does someone subscribe to the vendor's security advisories and to CISA's Known Exploited Vulnerabilities catalog, which CISA tells organizations to use as an input to prioritization? Is there a named owner on weekends?
3. Patch speed on the edge. Do you have a target, in days, for critical fixes on internet facing systems, and do you measure it? Edge devices usually need a shorter target than internal servers.
4. Fast disable. Both advisories offered disabling SSL VPN as a workaround. Do you know who can turn a feature off in an emergency, and what breaks when they do? Have you tested the fallback access path?
5. Unsupported versions. The 2022 advisory listed versions with no fix that required migration. Do you know which of your devices run end of life software?
6. Indicator hunting. When a vendor publishes indicators of compromise, can someone check for them across your devices within a day?
7. Logs off the box. If an attacker changes a device, are its logs already stored somewhere they cannot reach?
8. Segmentation. If a VPN gateway is compromised, what can it reach? Does it sit in a zone with limited access to internal systems?
9. Strong authentication. Is multi factor authentication in place for remote access, so stolen credentials alone are not enough? It will not help against an unauthenticated flaw, but it limits what follows.
10. Rehearsal. Have you run a tabletop for this exact scenario: a critical advisory on your VPN at 5 pm on Friday?
How do you read the score?
Count the yes answers. Eight or more is a mature posture. Five to seven means you have gaps worth closing in a quarter. Under five means start with items 1, 2 and 4, because they cost little and shorten every later step.
What to do this month
- Build the edge inventory with versions and owners.
- Subscribe a shared mailbox to vendor advisories and the KEV feed.
- Write the emergency disable runbook for each internet facing service.
- Ship device logs to a separate store.
- Run the tabletop and write down what was slow.
Quick check
Would multi factor authentication have stopped these flaws?
Not on its own. Both advisories describe unauthenticated attacks against the service, so credentials were not the barrier.
Is disabling the VPN realistic?
Only if you have planned for it. Test the fallback access path before an emergency, not during one.
Sources
- Fortinet PSIRT FG-IR-22-398 (CVE-2022-42475)
- Fortinet PSIRT FG-IR-24-015 (CVE-2024-21762)
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
