CVE-2022-40684 Critical Fortinet Authentication

**Executive Summary:** Arctic Wolf observed active exploitation of CVE-2022-40684 (a critical remote authentication bypass in FortiOS, FortiProxy, and FortiSwitchManager) enabling attackers to download device configuration files, create privileged accounts, and run scripts; the advisory lists affected and fixed versions and provides prioritized mitigations including upgrading firmware, disabling external admin access, enforcing MFA, performing clean device reinstalls, rotating credentials, and revoking exposed certificates.