CVE-2018-13379

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

First PoC 2019-08-19
2221 days →Metasploit 2025-09-16
395 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

4 known · links only

Metasploit1

FortiOS Path Traversal Credential Gatherer ↗
Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests. This module exploits this vulnerability to read the usernames and passwords of users currently logged into the FortiOS SSL VPN, which are stored in plaintext in the "/dev
ruby · seen 2026-10-18

Exploit-DB2

Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure ↗
created 2019-08-19
Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit) ↗
created 2019-08-19

Nuclei1

Fortinet FortiOS - Credentials Disclosure ↗
Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests due to improper limitation of a pathname to a restricted directory (path traversal).
yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Tied by cited sources to

ENERGETIC BEAR
1. “CVE-2018-13379 FortiGuard FortiOS SSL VPN BERSERK BEARCOZY BEAR”
  cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17
pay2key
1. “This server was vulnerable to Fortinet SSL VPN (CVE-2018-13379)9. We assess that this server was hacked by the threat actor using this exploit.”
  cited as exploiting · named nearby · source: clearskysec.com ↗ · 2026-10-17
OilRig
1. “APT34 External Remote Services - T1133 CVE-2019-11510 CVE-2018-13379 CVE-2018-1579”
  attributed by a report · source: clearskysec.com ↗ · 2026-10-17
Fox Kitten
1. “Fortinet VPN servers running FortiOS (CVE-2018-13379)”
  cited as exploiting · named nearby · source: zdnet.com ↗ · 2026-10-17
2. “Fortinet VPN servers running FortiOS (CVE-2018-13379)”
  cited as exploiting · named nearby · source: zdnet.com ↗ · 2026-10-17
DEV-0270
1. “In many of the observed DEV-0270 instances, the actor gained access by exploiting known vulnerabilities in Exchange or Fortinet (CVE-2018-13379).”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
APT35
1. “Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
lockbit
1. “LockBit affiliates gain access via compromised servers, or by using RDP or VPN accounts using brute force insecure credentials. A further delivery method is by exploiting Fortinet VPN CVE-2018-13379 vulnerability.”
  cited as exploiting · source: security.packt.com ↗ · 2026-10-17
POLONIUM
1. “This suggests, but does not definitively prove, that POLONIUM compromised these Fortinet devices by exploiting the CVE-2018-13379 vulnerability to gain access to the compromised organizations.”
  attributed by a report · source: microsoft.com ↗ · 2026-10-17
APT29
1. “APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “CVE-2018-13379 FortiGuard FortiOS SSL VPN BERSERK BEARCOZY BEAR”
  cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals