Vulnerability intelligence

CVE-2018-13379

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.

CVSS Score

9.1

Critical

EPSS — Exploit Probability

—

Awaiting FIRST.org data

Exploitation

Confirmed in the wild

Used in ransomware campaigns

Remediation

unknown

Federal deadline 2022-05-03

CISA required action

Apply updates per vendor instructions. Deadline for federal agencies: 2022-05-03.

NVD entry PoC / advisory CISA KEV

1 article across 1 outlet · first covered Sep 15, 2026 · latest Sep 15, 2026

Coverage timeline

Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BB
www.securityweek.com · Sep 15, 2026

Related CVEs — Fortinet

CVE-2022-42475KEV CVE-2023-27997KEV CVE-2024-21762KEV CVE-2025-25249KEV CVE-2026-26084 CVE-2026-84393 CVE-2024-55591KEV CVE-2026-26035