PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-13374 Fortinet CVE debrief

CVE-2018-13374 is an improper access control issue affecting Fortinet FortiOS and FortiADC. In the supplied official records dated 2022-09-08, CISA lists the issue in its Known Exploited Vulnerabilities catalog, which means it is known to be actively exploited. CISA also marks the vulnerability as associated with known ransomware campaign use and directs organizations to apply updates per vendor instructions.

Vendor
Fortinet
Product
FortiOS and FortiADC
CVSS
MEDIUM 4.3
CISA KEV
Listed
Original CVE published
2022-09-08
Original CVE updated
2022-09-08
Advisory published
2022-09-08
Advisory updated
2022-09-08

Who should care

Organizations that run Fortinet FortiOS or FortiADC should treat this as a priority, especially teams responsible for internet-facing appliances, perimeter security, and incident response.

Technical summary

The supplied records identify CVE-2018-13374 as an improper access control vulnerability in Fortinet FortiOS and FortiADC. The CISA KEV entry confirms known exploitation and notes known ransomware campaign use. The only remediation guidance present in the supplied corpus is to apply updates per vendor instructions.

Defensive priority

Urgent / Immediate

Recommended defensive actions

  • Inventory Fortinet FortiOS and FortiADC deployments to confirm whether any affected systems are present.
  • Apply vendor updates per Fortinet instructions as soon as possible.
  • Prioritize exposed or internet-facing devices for remediation.
  • Review administrative and authentication activity on Fortinet devices for signs of suspicious access.
  • Use the official Fortinet advisory referenced by CISA KEV to verify the correct fixed releases and remediation steps.

Evidence notes

This debrief is limited to the supplied CISA KEV metadata and the official CVE/NVD records included in the corpus. The KEV entry lists dateAdded as 2022-09-08, dueDate as 2022-09-29, requiredAction as 'Apply updates per vendor instructions,' and knownRansomwareCampaignUse as 'Known.' No CVSS score or severity was provided in the supplied record.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-13374 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-13374

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-13374 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-13374

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.