CVE-2018-13383: Fortinet FortiOS and FortiProxy Out-of-bounds Write
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
Published May 29, 2019 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Fortinet vulnerabilities
All Fortinet entriesCVE-2026-104286
Fortinet FortiMail Path Traversal Vulnerability
critical9.8ExploitedOct 1, 2026CVE-2026-25089
Fortinet FortiSandbox OS Command Injection Vulnerability
critical9.8ExploitedJun 9, 2026CVE-2025-61624
Fortinet Multiple Products Path Traversal Vulnerability
medium6.5ExploitedApr 14, 2026CVE-2026-39808
Fortinet FortiSandbox OS Command Injection Vulnerability
critical9.8ExploitedApr 14, 2026CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability
critical9.8ExploitedApr 4, 2026CVE-2025-68686
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
medium5.9ExploitedFeb 10, 2026