CVE-2022-26122: 
FortiOS vulnerability analysis and mitigation

An insufficient verification of data authenticity vulnerability [CWE-345] was identified in FortiClient, FortiMail, and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below. The vulnerability was disclosed on November 1, 2022, and assigned CVE-2022-26122 with a medium severity rating and a CVSSv3 score of 4.3 (Fortiguard PSIRT, CVE Mitre).

The vulnerability allows attackers to bypass the AV engine through manipulation of MIME attachments using junk and pad characters in base64 encoding. This represents an insufficient verification of data authenticity issue, categorized as CWE-345. The vulnerability affects multiple Fortinet products running specific AV engine versions, including FortiOS, FortiMail, and FortiClient (Fortiguard PSIRT).

The primary impact of this vulnerability is a potential denial of service condition and the ability to bypass antivirus scanning mechanisms. The medium severity rating (CVSS score 4.3) indicates significant but not critical risk to affected systems (Fortiguard PSIRT).

Fortinet has released several mitigation paths including upgrading AV engine to version 6.00169 or above, or version 6.00275 or above. For FortiMail, upgrades to versions 7.2.0, 7.0.3, or 6.4.7 are recommended. FortiOS users should upgrade to version 7.0.8 or 7.2.2 or above (Fortiguard PSIRT).