September 8, 2022 · Applied Cybernetics Group
CVE-2018-13374 — Fortinet FortiOS and FortiADC
known ransomware use
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
- Added to KEV
2022-09-08- Federal due date
2022-09-29- Vendor
- Fortinet
- Product
- FortiOS and FortiADC
- EPSS
- 98.4th percentile (score 0.381, as of
2026-07-13) - NVD CVSS v3.1
- —
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2018-13374
CISA short description
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
Required action
Apply updates per vendor instructions.