Is CVE-2018-13382 (Fortinet FortiOS and FortiProxy Improper Authorization) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2018-13382 to its Known Exploited Vulnerabilities catalogue on 10 January 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.

What “being exploited in the wild” means for this CVE

For CVE-2018-13382, the practical answer is yes: CISA’s KEV listing is the strongest public signal that exploitation is not hypothetical. For defenders, that means the question is no longer whether the flaw is interesting, but whether any exposed FortiOS or FortiProxy instance is still reachable, still vulnerable, or already showing signs of abuse. The KEV status also makes this a triage and containment problem, not just a patching item.

When a flaw sits in SSL VPN web portal exposure, the first verification step is usually asset and exposure confirmation. You need to know which appliances are internet-facing, which ones provide SSL VPN access, and whether any administrative or authentication paths are reachable from untrusted networks. The question is operational because internet-facing edge systems tend to be scanned quickly after public exploitation becomes known.

For a concise way to frame the response path, use an incident-style workflow: confirm scope, apply the vendor fix or mitigation, then validate whether the device was touched before the update window closed. CISA’s Known Exploited Vulnerabilities Catalog is the authoritative signal that this class of issue should be handled as active-exploitation risk, while the vendor advisory should drive the version-specific remediation decision.

Why this Fortinet flaw is operationally dangerous

The underlying issue is an improper authorization condition in a remote-access surface that can be reached by unauthenticated users. That matters because VPN portals are high-value choke points: they sit at the boundary between public traffic and trusted internal access, so a weakness there can become a direct path into accounts, sessions, or connected services. The immediate concern is not just password modification, but the control loss that comes from any unauthenticated action against authentication-adjacent functionality.

In practice, internet-facing access gateways are attractive to attackers because they combine broad exposure with high leverage. Once a weakness in that layer is exploited, defenders may see account tampering, session abuse, credential reset abuse, or follow-on authentication failures rather than a clean “malware” signature. That is why exploitation of this kind often blends into normal remote-access noise unless logging and alerting are strong enough to distinguish legitimate portal activity from abuse.

Edge Device Security Guide is the most relevant internal reference for this failure mode because it treats exposed appliances, management reachability, logging minimums, and lifecycle pressure as one problem, not separate concerns.

What defenders should check when patching cannot happen immediately

If you cannot remediate at once, the priority is to reduce exposure and look for evidence of earlier compromise. That means restricting external reachability, reviewing VPN and authentication logs, and checking whether any passwords, sessions, or administrative actions changed during the suspected exposure window. If the portal was reachable from the internet, assume automated probing may already have occurred and treat the device as a live investigation target until proven otherwise.

Where the appliance supports it, isolate it from direct internet exposure, disable unnecessary VPN paths, and increase monitoring on authentication and password-change events. Also review any downstream systems that trust the appliance for identity or access decisions. A flaw that touches remote access can have a longer tail than the device itself because the consequence may be stolen access rather than a damaged appliance.

For deeper handling of this class of event, the Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide together support the triage logic: confirm exposure, prioritise KEV-listed items, verify remediation, and then perform compromise assessment rather than assuming patching alone closed the case.

Risk and Threat Considerations

Because this CVE is publicly known to be exploited and linked to ransomware activity, the risk is not limited to service disruption. Remote-access weaknesses are often used as initial access points, then converted into credential theft, session abuse, or broader intrusion paths. In other words, the issue can create both immediate exposure and delayed consequence if an attacker used the portal before remediation.

Failure mechanism: An unauthenticated attacker can abuse the authorization flaw in the SSL VPN web portal to alter a password, which can undermine trust in the login flow and enable unauthorized access or account takeover.

Impact: Organisations may face remote access compromise, follow-on lateral movement, credential reset abuse, and ransomware-enabled intrusion paths if the appliance was reachable and unmonitored during the exploitation window.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires prioritising exposed vulnerabilities and remediation tracking.
Recommendation — Prioritise and remediate KEV-listed internet-facing appliance flaws first.
NIST CSF 2.0	PR.AA-01 — Identity Management, Authentication, and Access Control	The flaw affects remote access authentication and authorization at the VPN boundary.
Recommendation — Enforce strong access control and review remote-access authentication paths.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Actively exploited vulnerability handling depends on timely remediation and verification.
Recommendation — Accelerate remediation and verify vulnerable components are updated or mitigated.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	An internet-facing VPN portal flaw fits public-facing exploitation behavior.
Recommendation — Monitor public-facing appliances for exploitation attempts and post-access activity.
OWASP ASVS	V8 — Authorization	The CVE is an improper authorization flaw affecting privileged portal behavior.
Recommendation — Test authorization checks on exposed portal functions and privileged actions.

Practitioner Guidance

What to prioritise: Treat any exposed FortiOS or FortiProxy SSL VPN instance as a high-priority asset if it was internet-facing during the KEV period. If the device served as a remote-access entry point, check authentication logs, password changes, and unusual source IPs before you focus on hardening extras.

What to verify: Verify three things in order: whether the vulnerable service was reachable, whether the vendor fix or mitigation has been applied, and whether there is evidence of access before remediation. If any of those answers is unclear, keep the case open rather than declaring it resolved.

Practitioner takeaway: For KEV-listed remote-access flaws, patch status is only the starting point, because the real decision is whether the appliance was already used as an access path into the environment.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org