CVE-2018-13382VulnerabilityPublished 01/10/2022Updated 10/24/2026

CVE-2018-13382: Fortinet FortiOS and FortiProxy Improper Authorization

Affects Fortinet FortiOS and FortiProxySource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/10/2022
KEV deadline: 07/10/2022
Ransomware: Used in ransomware campaigns
EPSS: 81.7% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2018-13382 (opens in a new tab)

Description

CVE-2018-13382 is an improper authorization vulnerability in Fortinet FortiOS and FortiProxy SSL VPN web portal that allows an unauthenticated attacker to modify user passwords. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the input data.

Summary

The vulnerability CVE-2018-13382 affects Fortinet FortiOS and FortiProxy products, specifically in the SSL VPN web portal component. It allows an unauthenticated attacker to bypass authorization controls and modify passwords. This improper authorization flaw can lead to unauthorized access and potential compromise of affected systems. The vulnerability has been observed in active exploitation scenarios, including ransomware campaigns.

Impact

An unauthenticated attacker can modify passwords via the SSL VPN web portal, potentially leading to unauthorized access to the affected Fortinet devices. This can compromise the confidentiality and integrity of the system and may facilitate further malicious activities such as ransomware deployment.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, organizations should monitor vendor communications for updates and consider restricting access to SSL VPN portals or applying compensating controls as appropriate.

Weaknesses

CWE-285Improper Authorization (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:56:36 UTC

Weaknesses

References

Related threats