CVE-2022-42475

Fortinet FortiOS SSL-VPN suffered a heap-based buffer overflow allowing unauthenticated remote code execution.

An unauthenticated remote attacker could execute arbitrary code via crafted requests to FortiOS SSL-VPN, enabling ransomware deployment and network compromise. DIB organizations must ensure all FortiOS versions are patched immediately, as this flaw was actively exploited in the wild and linked to ransomware campaigns. The failure highlights the risk of relying on core security infrastructure with known, unpatched vulnerabilities.

Shame score — A critical RCE in a core security product was actively exploited in the wild and linked to ransomware, demonstrating severe negligence in patching known vulnerabilities.