CVSS—
Severityhigh
Weakness—
EPSS99.5%99.9th percentile
Exploited3 KEV sources
Ransomware useKnown
Federal fix dueJan 3, 2023
patch window
Called exploited 21 days before disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing21d
- Last KEV listing1d
- Last sighting3.6y
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Dec 13, 2022
- EUVDENISA, European Unionlisted Dec 13, 2022
- VulnCheck KEVcommercial researchlisted Dec 12, 2022
- CIRCLaggregator, mirrors the abovelisted Dec 13, 2022, not counted
Sources3 of 3
Listings differ by1 d
Strongest claimconfirmed
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationblog.qualys.com/vulnerabilities-threat-research/2026/07/08/f
- reported exploitationwww.cloudsek.com/blog/operation-escaneo-mexican-government-f
- reported exploitationhorizon3.ai/wp-content/uploads/2026/03/Iranian_APT_TTP_Repor
- reported exploitationfortgale.com/blog/defence/operation-storming-tide/
- reported exploitationwww.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf
- reported exploitationctrlaltintel.com/threat%20research/MuddyWater/
66 public reports collected from VulnCheck and CIRCL, first on Dec 12, 2022. Each links to its original source. We have not verified them.
Description
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Required action (CISA)
Apply updates per vendor instructions.
