StrikeShark Fortinet CVE-2022-40684 and CVE-2024-21762 Exploitation Attempt

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•4

Detects suspicious HTTP requests and API activity targeting Fortinet devices, specifically matching patterns associated with known vulnerabilities like CVE-2022-40684 and CVE-2024-21762. The rule monitors for unauthorized REST API calls, attempts to interact with sensitive administrative endpoints, and patterns indicating potential authentication bypass or remote code execution attempts on FortiGate, FortiOS, and FortiProxy appliances.