CVE-2018-13374: Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

CVE-2018-13374 is an improper access control vulnerability in Fortinet FortiOS and FortiADC. It lets an attacker obtain LDAP server login credentials that are configured on a FortiGate device by directing an LDAP connectivity test toward a server they control. Because those credentials often unlock directory services used for authentication and authorization, successful abuse can give an attacker a foothold into identity infrastructure. CISA notes that this vulnerability has been used in ransomware activity, so organizations running the affected products should treat it as a priority.

How it works

The weakness is classified as CWE-732 (incorrect permission assignment for a critical resource). In plain terms, the product does not adequately restrict who may initiate or redirect an LDAP server connectivity test. An attacker who can trigger that test can point it at a rogue LDAP server under their control. When the FortiGate device attempts the test, it may send the configured LDAP bind credentials to the attacker-controlled server, exposing them.

Exact preconditions, authentication requirements, and request formats are not detailed in the public summary; defenders must confirm those specifics against the vendor advisory. The core abuse path remains credential theft via a misdirected connectivity check rather than a complex memory-corruption exploit.

Am I affected? How to find it in your systems

FortiOS runs on FortiGate firewalls and related Fortinet security appliances; FortiADC is Fortinet’s application delivery controller. Both commonly sit at network perimeters, in DMZs, or as internal segmentation gateways, and both are frequently integrated with corporate LDAP or Active Directory for admin or user authentication.

• Inventory all FortiGate and FortiADC devices via your CMDB, network management platform, or by scanning management interfaces for Fortinet banners and HTTPS certificates.
• Record the running firmware version on each device and compare it with the fixed versions listed in Fortinet’s advisory for CVE-2018-13374; do not assume a version is safe without that check.
• Identify any devices that have LDAP servers configured for authentication, group lookup, or admin login—these are the configurations that expose credentials if the test feature is abused.
• Review logs for unexpected LDAP connectivity tests, sudden outbound connections from the management or LDAP client process to unfamiliar IP addresses, or authentication anomalies against your real LDAP servers shortly after such tests.

Telemetry signs of exploitation are not exhaustively documented in the public summary; treat any unexplained LDAP bind attempts originating from Fortinet devices as suspicious and investigate.

How to remediate

Patch first. Apply the updates Fortinet released for FortiOS and FortiADC exactly as described in the vendor advisory. CISA’s required action is to apply updates per vendor instructions; confirm the precise build numbers and upgrade path against that advisory before rolling out.

• After upgrading, verify the new version is running and that LDAP configurations still function as intended.
• Rotate any LDAP service-account passwords that were configured on the affected devices, because those credentials may already have been exposed.
• Restrict which administrators or automation accounts can initiate LDAP connectivity tests, and limit the source addresses that can reach the management plane.
• Where possible, use least-privilege LDAP accounts that have only the bind and search rights required, rather than highly privileged directory accounts.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment management interfaces so they are reachable only from a hardened jump host or management VLAN; block general user and internet access to those ports.
• If the LDAP connectivity-test feature can be disabled or restricted by policy, do so until the patch is installed.
• Deploy network or host-based controls (firewall rules, IPS/WAF signatures if available) that detect or block outbound LDAP traffic from Fortinet devices to non-approved directory servers.
• Increase monitoring on both the Fortinet devices and your LDAP servers for anomalous bind attempts, unexpected destination IPs, and privilege-use alerts.
• Ensure LDAP credentials stored on the devices are unique, rotated on a short cycle, and monitored for use from unexpected locations.

These steps do not eliminate the vulnerability; they only lower the likelihood of successful credential theft until the official fix is in place.

If your data may have been exposed

Vulnerabilities that have been exploited in ransomware campaigns frequently lead to broader network compromise and data theft. If you discover that an unpatched FortiOS or FortiADC device was reachable and had LDAP credentials configured, assume those credentials may have been taken and rotate them immediately. Review directory logs for unauthorized binds, lateral movement, and ransomware precursors. As an additional check, you can run a free exposure scan of your email addresses against known breach data to see whether associated accounts have appeared in prior incidents.