Is CVE-2018-13374 being actively exploited?

Yes. CVE-2018-13374 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on September 8, 2022.

What is the CVSS score for CVE-2018-13374?

CVE-2018-13374 has a CVSS 3.1 base score of 4.3 (MEDIUM).

CVE-2018-13374

MEDIUM · CVSS 4.3CISA KEV: actively exploitedEPSS 38.1%EU EUVD: exploited

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Key facts

CVSS score: 4.3 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-732
EPSS score: 38.1% (99th percentile)
In CISA KEV: Yes, added September 8, 2022
In EU EUVD: Yes (EUVD-2018-5318)
Published: January 22, 2019
NVD last modified: October 1, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Added to the KEV catalog on September 8, 2022; federal remediation due September 29, 2022. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2018-5318 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 1, 2026.

View on the EU Vulnerability Database

Affected products

fortinet / fortiadc
fortinet / fortiadc
fortinet / fortios

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

FortiOS 5.6 - Fortinet, Inc. - FIPS 140 3639 - historical
FortiOS 5.2 - Fortinet, Inc. - FIPS 140 2765 - historical
FortiOS™ - Fortinet, Inc. - FIPS 140 1754 - historical
FortiOS - Fortinet, Inc. - FIPS 140 1431 - historical

References

https://fortiguard.com/advisory/FG-IR-18-157(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13374(US Government Resource)

Last updated October 3, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain