CVE-2018-13374: Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
Published Jan 22, 2019 · Updated Oct 1, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Fortinet vulnerabilities
All Fortinet entriesCVE-2026-104286
Fortinet FortiMail Path Traversal Vulnerability
critical9.8ExploitedOct 1, 2026CVE-2026-25089
Fortinet FortiSandbox OS Command Injection Vulnerability
critical9.8ExploitedJun 9, 2026CVE-2025-61624
Fortinet Multiple Products Path Traversal Vulnerability
medium6.5ExploitedApr 14, 2026CVE-2026-39808
Fortinet FortiSandbox OS Command Injection Vulnerability
critical9.8ExploitedApr 14, 2026CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability
critical9.8ExploitedApr 4, 2026CVE-2025-68686
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
medium5.9ExploitedFeb 10, 2026