Servers and applications
CVE-2018-13374
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 8 Sept 2022.
- Severity
- Medium 4.3
- Published
- 22 Jan 2019
- Last changed
- 1 Oct 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 6.0.3
- Exploit chance
- 38% in the next 30 daysHigher than 98% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios |
|
Known exploited
- CISA name
- Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
- Required action
- Apply updates per vendor instructions.
- Due for US agencies
- 29 Sept 2022
- Used in ransomware
- Yes, known