Is CVE-2018-13383 (Fortinet FortiOS and FortiProxy Out-of-bounds Write) being exploited in the wild?

Yes. CISA added CVE-2018-13383 to its Known Exploited Vulnerabilities catalogue on 10 January 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

What “exploited in the wild” means for this CVE

For this question, the practical test is whether defenders should treat the issue as an active exposure rather than a theoretical weakness. CISA’s KEV listing is the strongest signal here because it exists to track vulnerabilities with credible evidence of exploitation, which makes this a prioritisation problem, not just a patch note.

When a vulnerability appears in KEV, the relevant decision is whether the affected product is present anywhere in your environment, whether the vulnerable feature is reachable, and whether the system can tolerate emergency remediation. For internet-facing security appliances, that usually means treating exposure as time-sensitive even if the vulnerable service is only used by a small set of users.

For broader tracking, teams should pair KEV status with vendor guidance and internal asset inventory so that exploitability is judged against actual deployment, not just the CVE record. CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm whether CISA still considers a flaw actively exploited.

Why FortiOS and FortiProxy exposure is operationally significant

The issue described here is an out-of-bounds write in a network edge product, which matters because appliance flaws often sit on the boundary between external traffic and administrative trust. A heap buffer overflow can do more than crash a process, it can destabilise the SSL VPN service that remote users depend on and may create a path to broader device compromise depending on the exploit conditions.

That combination makes the problem especially important for organisations that rely on the device for remote access, branch connectivity, or security enforcement. Edge Device Security Guide is useful here because it frames the real control questions around exposed management surfaces, logging, hardening, and lifecycle planning for internet-facing appliances.

The other practical point is that exploitation of an edge appliance can be difficult to observe from endpoint telemetry alone. If the device is the trust boundary, defenders need to assume that compromise may be partially invisible to standard host-based monitoring and should review device logs, authentication activity, and configuration changes as first-class evidence.

For root-cause context, this class of defect falls squarely into memory-safety weakness territory. CWE Top 25 Guide helps explain why buffer overflows and out-of-bounds writes remain high-risk even when the immediate symptom is service disruption rather than an obvious data theft event.

How to triage and respond when patching cannot wait

Start by confirming whether any FortiOS or FortiProxy instance is actually exposed to the vulnerable SSL VPN path, then decide whether emergency mitigation is needed before routine maintenance can happen. If the device is internet-facing or is supporting remote access for privileged users, treat the patching decision as urgent and time-bound.

If you cannot patch immediately, the fallback is to reduce reachable exposure, tighten access to the VPN surface, and monitor for signs that the service has been disrupted or tampered with. Zero-Day and Exploited Vulnerabilities Guide aligns with that response pattern because it focuses on emergency mitigation, compromise assessment, and post-patch hunting for vulnerabilities that are already being used.

For prioritisation, check the vendor advisory and then compare KEV status with your own exposure. The NVD and CVE Program are the right records for canonical vulnerability identity and product context, while CISA KEV tells you why this should move ahead of ordinary backlog work. NIST National Vulnerability Database and CVE Program remain the reference points for those details.

Risk and Threat Considerations

Actively exploited VPN and edge-device flaws are attractive because they combine external reachability with access to a privileged trust boundary. Even when the first visible effect is service termination, the deeper risk is that attackers may use the weakness to gain a foothold, interfere with remote access, or stage follow-on activity against internal systems.

Failure mechanism: An out-of-bounds write can corrupt memory in the SSL VPN service, which may crash the process, destabilise the appliance, or under some conditions enable deeper compromise of the device.

Impact: Remote access can fail for legitimate users, logs may be incomplete, and the appliance may become an entry point for broader intrusion or ransomware staging if exploitation succeeds.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploited flaws require prioritised identification and remediation.
Recommendation — Prioritise and remediate exposed FortiOS and FortiProxy instances immediately.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE demands timely flaw remediation and tracking for vulnerable systems.
Recommendation — Track, test, and apply remediation for affected Fortinet appliances without delay.
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to find potentially adverse events	Exploitation of an edge appliance requires monitoring for service anomalies and compromise signs.
Recommendation — Monitor FortiOS and FortiProxy service behaviour for signs of exploitation or disruption.
OWASP ASVS	V13 — Configuration	Edge security products must be securely configured and hardened to reduce exploit exposure.
Recommendation — Harden exposed VPN and management surfaces on the appliance.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The CVE affects an internet-reachable service that attackers can target remotely.
Recommendation — Map exposed Fortinet services to public-facing attack paths and hunt accordingly.

Practitioner Guidance

What to prioritise: Treat the VPN appliance as a high-value exposure point, not a routine patch item. Confirm whether the vulnerable service is internet-reachable, whether any privileged access depends on it, and whether the device supports the organisation’s incident response and recovery process.

What to verify: Check device logs, authentication events, configuration drift, and any unexpected restarts or VPN interruptions around the KEV date and after. If you see evidence of anomalous access or service instability, escalate to compromise assessment rather than assuming this is only a denial-of-service condition.

Practitioner takeaway: For KEV-listed edge-device flaws, the question is not simply whether a patch exists, it is whether the appliance can still be trusted as a boundary while remediation is in progress.