How do you patch or mitigate CVE-2018-13379 (Fortinet FortiOS SSL VPN Path Traversal)?

By NHI Mgmt Group Editorial Team Updated October 18, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2018-13379 is to apply updates per vendor instructions. In practice, find every instance of Fortinet FortiOS in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What CVE-2018-13379 Means for Exposure and Remediation

The practical question is not just whether FortiOS SSL VPN is installed, but whether any instance is still reachable in a way that lets an attacker exercise the path traversal condition. If the vulnerable service is present, remediation starts with vendor-directed updates, then moves immediately to exposure reduction for systems that cannot be fixed in place. The biggest mistake is treating this as a “patch later” issue when the product still has direct internet reachability.

For readers who need a broader response model for VPN and edge-device exposure, the VPN Security Guide covers patching, hardening, replacement options, and the operational reality that remote-access appliances need tighter lifecycle control than ordinary internal systems.

How to Confirm You Are Actually Protected

Validation should begin with complete asset discovery, because remediation is only meaningful if you know every Fortinet FortiOS deployment that could still be exposed. Confirm which systems are internet-facing, which are behind compensating controls, and which are already outside the support or patch window. Where the product cannot be updated quickly, reduce exposure first by removing public access or taking the service out of use.

Once the update or mitigation is applied, verify that the vulnerable path is no longer available and that the device is no longer reachable from untrusted networks unless there is a documented business reason. In practice, this means checking the real external attack surface rather than assuming a change ticket or maintenance window equals protection.

For vulnerability handling at scale, the Vulnerability Management Guide is useful because it frames exposure, prioritisation, exception handling, and verification as one workflow instead of separate tasks.

What to Check After Patching or Mitigation

CVE-2018-13379 is material because exploitation can happen before defenders notice the device was vulnerable. That makes post-fix review part of the response, not an optional clean-up step. Review available logs for suspicious requests, odd file retrieval patterns, unexplained authentication activity, or other indicators that the appliance may have been used before the update or shutdown.

If you find signs of compromise, treat the issue as a credential and session exposure problem as well as a software flaw. VPN appliances sit on a trust boundary, so earlier exploitation can justify resetting credentials, revoking sessions, and checking adjacent systems that may have been accessed through the appliance.

Risk and Threat Considerations

This flaw is risky because edge VPN products are high-value targets: they sit in front of internal resources, often have broad trust, and are frequently exposed to the internet. When attackers exploit a path traversal issue in that position, the initial impact can extend beyond the appliance itself into credentials, sessions, and downstream network access.

Failure mechanism: The attacker abuses the traversal condition to reach files or data that should not be accessible remotely, then uses that access to support follow-on compromise, persistence, or internal reconnaissance before defenders fully respond.

Impact: The likely consequence is not just service exposure, but potential theft of secrets or session material, unauthorised access to internal resources, and a longer incident response effort because the vulnerable edge device may have served as an entry point.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE-2018-13379 is a vulnerability exposure and remediation problem.
	CIS-12 — Network Infrastructure Management	FortiOS SSL VPN is an internet-facing edge service that needs exposure control.
Recommendation — Prioritize, patch, and verify the FortiOS exposure under continuous vulnerability management. Restrict and monitor internet-facing VPN access paths to reduce edge-device exposure.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The response requires finding affected instances and validating remediation.
	SI-2 — Flaw Remediation	The required action is to apply vendor updates or mitigations.
	AC-4 — Information Flow Enforcement	Removing exposure or taking the service out of use aligns with limiting inbound trust paths.
Recommendation — Scan for vulnerable FortiOS instances and validate that remediation closed the exposure. Apply the vendor update or documented mitigation and track completion. Block untrusted access paths to the VPN service until remediation is complete.

Practitioner Guidance

What to prioritise: Patch or isolate every internet-facing FortiOS SSL VPN instance first, then work inward. If a system cannot be updated immediately, removing exposure is the safer control choice than leaving a known exploitable edge service online.

What to verify: Confirm that your remediation evidence includes the specific device inventory, the applied vendor update or mitigation, and a post-change check that the vulnerable path is no longer reachable. Do not rely on a maintenance record alone.

Decision rule: If there is any credible chance the appliance was reachable while vulnerable, review logs and adjacent authentication activity before closing the case. If there is no reliable logging, assume the incident could be older than the patch window and widen your review accordingly.

Practitioner takeaway: For exploited edge VPN flaws, “patched” is only half the answer, the other half is proving the device was not left exposed long enough to become a pivot into the rest of the environment.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org