---
id: "CVE-2018-13382"
kind: "vulnerability"
aliases: ["CVE-2018-13382"]
title: "Fortinet FortiOS and FortiProxy: Fortinet FortiOS and FortiProxy Improper Authorization"
severity: "critical"
cvss: 9.1
epss: 0.81691
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Fortinet FortiOS and FortiProxy", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortios", "fortiproxy", "ransomware", "self-hosted", "ssl-vpn", "vendor"]
not_affected_if: ["ssl-vpn-disabled"]
published_at: "2019-06-04T21:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-13382", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-13382", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13382", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Fortinet FortiOS and FortiProxy: Fortinet FortiOS and FortiProxy Improper Authorization

Fortinet FortiOS and FortiProxy have an improper authorization flaw in the SSL VPN web portal. An unauthenticated attacker can change a user's password, which can lead to VPN account takeover.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fortinet FortiOS and FortiProxy affected ? fixed ?

## How to check

Check whether the SSL VPN web portal is enabled on FortiOS or FortiProxy devices and confirm the firmware version against the vendor advisory. unknown for exact affected version range from these sources.

## Fix

Apply the vendor firmware update per Fortinet's advisory; CISA requires applying updates per vendor instructions. Exact fixed version: unknown.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-13382
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-13382
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-13382

## From the sources

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_