CVE-2018-13379: Fortinet FortiOS SSL VPN pre-auth file read, still exploited years on
The short version: FortiOS's SSL VPN web portal has a path-traversal flaw (CVE-2018-13379) that lets an unauthenticated attacker download system files — including a session file that can contain plaintext VPN credentials. Patching closes the hole, but any credentials that leaked before you patched still work. It's in CISA's KEV catalog and, years after the fix, it's still one of the most exploited Fortinet flaws. Steady hands — patch and rotate credentials.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice (see below) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-03 |
| Known exploited? | Yes — mass-exploited by APT and ransomware actors; leaked-credential dumps posted publicly |
| Vulnerability type | CWE-22 path traversal → unauthenticated system-file read → VPN credential disclosure |
| Requires authenticated session? | No — pre-authentication |
| Affected | FortiOS 5.4.6–5.4.12, 5.6.3–5.6.7, 6.0.0–6.0.4 (SSL VPN enabled); FortiProxy 1.0–1.2, 2.0.0 |
| Fixed in | FortiOS 5.4.13 · 5.6.8 · 6.0.5 · 6.2.0 and later |
What you need to know
CVE-2018-13379 is a directory traversal in the FortiOS SSL VPN web portal. With a specially crafted, unauthenticated request, an attacker walks outside the intended directory and downloads system files — critically, a session file that in many configurations holds usernames and passwords in cleartext.
That's why this one has such a long tail. Mechanically it's "just" a file read, but what it reads is a set of working VPN credentials:
- How they find it — internet-wide scanning trivially surfaces exposed FortiGate SSL VPN portals.
- How they use it — pull the session file, harvest credentials, and log into the VPN as a legitimate user; large dumps of harvested FortiGate credentials have been posted publicly.
- What it leads to — authenticated VPN access to the internal network, which is why it's a staple of both APT and ransomware initial-access playbooks.
How serious we see it
Critical — in practice, and the reasoning matters.
The base score is 9.8, but even where a case looks like "only" information disclosure, the information here is a key that unlocks the VPN. Patching removes the file-read, but it does not un-leak credentials that were already stolen — which is exactly why this flaw keeps producing intrusions years later. We rate it by what it does: hand an attacker valid remote-access credentials. The bounded part is that it affects specific, now-old FortiOS versions and the fix is long available; the discipline it demands is credential rotation, not just patching.
Recommendations
Straight from Fortinet's advisory (FG-IR-18-384) and CISA:
- Patch now. Upgrade to FortiOS 5.4.13 / 5.6.8 / 6.0.5 / 6.2.0 or later — these old branches should be well past due.
- Rotate every VPN credential — the step people miss. Assume any password on an exposed, unpatched appliance leaked, and reset it. Enforce MFA on the SSL VPN.
- Hunt for prior use. Review VPN authentication logs for logins from unexpected locations and impossible-travel patterns.
- Harden exposure. Restrict management access and limit who can reach the SSL VPN portal.
- Confirm your exposure first. Verify whether any FortiGate SSL VPN is internet-facing and on an affected build.
How BreachRisk sees it
BreachRisk discovers internet-facing FortiGate SSL VPN portals from little more than your domain, fingerprints the FortiOS version, and flags exposure tied to KEV-listed, actively exploited flaws like this one — surfaced at the top of your results because it's in KEV. Where authorized, it goes beyond detection and safely performs a bounded, non-disruptive check against the vulnerable endpoint to confirm the traversal actually returns data, rather than flagging a maybe.
The value of a continuous, attacker's-eye view is exactly for a flaw with this kind of long tail: the exposed appliance is already ranked by how it actually gets used against you — as a credential-harvesting front door.