CVE-2018-13374 is an improper access control vulnerability in Fortinet FortiOS and FortiADC. CISA added it to the Known Exploited Vulnerabilities catalogue on 8 September 2022, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability class means in practice
An improper access control flaw means the product does not consistently enforce who may reach a protected function, resource, or management path. In FortiOS and FortiADC, that kind of weakness is especially dangerous because these systems sit close to the trust boundary and can influence traffic, configuration, and administrative control.
For defenders, the key issue is not just that a bug exists, but that a reachable control-path weakness can let an attacker bypass intended restrictions. That is why CISA KEV inclusion matters: it signals real-world exploitation and makes exposure more urgent than a theoretical product defect.
Why improper access control is high risk in edge and security appliances
Access control failures in perimeter or traffic-management products can have outsized impact because a single successful request may expose data, configuration functions, or deeper network reach. In practice, attackers value these flaws because they can turn an externally facing appliance into a stepping stone for broader compromise.
The danger is often less about one feature and more about the trust the device already has. If an attacker can reach administrative or privileged paths they should not see, they may alter policy, intercept traffic, or pivot to adjacent systems that rely on the appliance’s enforcement role.
Readers should treat this class of issue as a control-plane problem, not just an application bug. Guidance on how access, privilege, and entitlement boundaries fail is usefully covered in Authorisation Models Guide and in the broader lifecycle context of IAM and IGA Basics.
How organisations assess exposure and prioritise remediation
Exposure checks should start with a precise asset inventory: identify every FortiOS and FortiADC instance, where it is deployed, and whether it is internet reachable or exposed through a partner path. Vendor advisories and the CISA KEV entry should then be used to confirm whether a device is in scope for urgent action.
Because exploitation was observed in the wild, priority should be driven by actual reachability and business criticality, not by patch cadence alone. When a device protects remote access, segmentation, or internet traffic, delay increases the chance that the flaw becomes an initial access path.
For general vulnerability triage and KEV-based prioritisation, Vulnerability Management Guide is the most relevant internal reference, while the authoritative external record is the NIST National Vulnerability Database and the official CVE Program.
Remediation, detection, and post-exploitation review
The preferred response is to apply the vendor fix or mitigation as soon as operationally possible. If patching must wait, restrict management exposure, remove unnecessary internet access, tighten source allowlists, and watch for anomalous requests against appliance interfaces and administrative functions.
Detection should extend beyond the vulnerable request pattern itself. Review logs for unusual authentication attempts, configuration changes, policy edits, new admin access, and signs that the appliance was used as a foothold for lateral movement. If exploitation is suspected, assume the device may have been used to observe or redirect traffic and investigate adjacent systems accordingly.
Where access-control failures and privilege abuse are part of the response model, the most useful navigation path is Top 10 Network Security Misconfigurations, because exposed management and weak boundary controls often amplify the impact of a CVE like this.
Risk and Threat Considerations
Improper access control in a perimeter appliance is risky because it can convert a defensive control into an attacker entry point. Once exploitation is possible, the attacker may gain visibility into traffic, manipulate policy, or use the device’s trust position to reach other internal assets.
Failure mechanism: The product fails to enforce a boundary between authorised and unauthorised requests, so a remote actor can access functions or data that should be restricted.
Impact: Exposure can include configuration tampering, traffic interception, credential capture, and further compromise of connected systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | Improper access control directly concerns limiting access to only what is needed. |
| PR.DS-01 — Data-at-Rest Protection | Compromise of these appliances can expose sensitive traffic or stored configuration data. | |
| Recommendation — Enforce least privilege on appliance management and service paths. Protect sensitive appliance data with appropriate encryption and access restrictions. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Access control failures are governed by least-privilege enforcement expectations. |
| IA-2 — Identification and Authentication (Organizational Users) | Management-plane access depends on strong authenticated user access. | |
| Recommendation — Restrict appliance functions to the minimum privileges required. Require strong authentication for all administrative access paths. | ||
| CIS Controls v8 | 5 — Account Management | Account and access governance are central when appliance controls are bypassed. |
| 12 — Network Infrastructure Management | The issue affects security appliances that control network boundaries. | |
| Recommendation — Audit and remove unnecessary administrative and service accounts. Harden and monitor network infrastructure devices and management interfaces. | ||
| ISO/IEC 27001:2022 | A.8.5 — Secure authentication | Unauthorised access to appliance functions implicates authentication controls. |
| Recommendation — Strengthen authentication for appliance and administrative access. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org