CVE WatchOct 1, 2026

CVE-2018-13374

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

CVSS

4.3

Medium

EPSS

38.1%

p99

KEV

YES

Sep 8, 2022

Exploit Today

0-100

Published: Jan 22, 2019 · Last modified: Oct 1, 2026 · CWE-732

EPSS · 30d

37.8%EPSS · 30 days38.1%

2026-09-182026-10-15

KEV catalog record

Product

Fortinet / FortiOS and FortiADC

Vulnerability

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Added to KEV

Sep 8, 2022

Remediate by

Sep 29, 2022

Known ransomware use

Yes

Summary description

Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.

Required action

Apply updates per vendor instructions.

Notes

https://www.fortiguard.com/psirt/FG-IR-18-157; https://nvd.nist.gov/vuln/detail/CVE-2018-13374

Technical description

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-964255.5 MED

—

———Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus4h CVE-2026-964247.8 HIG

—

———Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus4h CVE-2026-922286.5 MED

—

———The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.9h CVE-2026-1027405.8 MED

—

——0The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.4h CVE-2026-34014—

2.6%

——1An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later1d CVE-2026-34008—

1.8%

——1An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later1d