CVE-2018-13379·Fortiproxy vulnerability

How Defensia detected this

Defensia agents read the web server logs of the Linux servers they protect and match incoming requests against exploitation signatures. When the same CVE is matched across enough independent servers, from enough distinct networks, it is recorded as being actively exploited. That threshold was crossed for CVE-2018-13379 starting 2026-10-01, across 7.4% of the servers Defensia monitors, from 7 distinct attacking IP addresses.

Every CVE we currently measure under active exploitation is listed together, with the share of servers targeted and how long each has been running.

Aggregated across every server Defensia monitors, over 5 days of observation, last measured 2026-10-23. Counts are of distinct servers and distinct source addresses, not of requests. No customer, host or domain is identified.

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 100% — among the highest-scoring CVEs ever published. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Upgrade FortiProxy to version 6.0.5 or later to patch the SSL VPN web portal path traversal vulnerability. This fix prevents unauthenticated attackers from downloading sensitive system files through specially crafted HTTP requests to the SSL VPN interface. Apply the update immediately as this affects all unauthenticated users with network access to the VPN portal.

sudo dnf update fortiproxy

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST request to /remote/login|/remote/console containing path traversal sequences (../ or %2e%2e%2f) followed by system file paths such as /etc/passwd, /etc/shadow, ../../../etc/passwd, config.tar, or system.log

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement WAF rules to block HTTP requests to SSL VPN endpoints (/remote/login, /remote/console, /remote/fgt_lang) containing encoded or literal path traversal patterns including '../', '..%2f', '%2e%2e%2f', and '\\..\\'. Restrict access to the SSL VPN portal to known trusted IP ranges where possible.

How to check if you are affected

1. SSH into your FortiProxy appliance and run 'show system status' or check the firmware version in the web UI under System > Dashboard to identify the current installed version.
2. Verify that the SSL VPN web portal is exposed to untrusted networks by checking 'show vpn ssl settings' and reviewing firewall rules that permit access to port 443 on the administrative interface.
3. Search FortiProxy logs for HTTP GET/POST requests containing path traversal patterns like '../' or encoded equivalents (%2e%2e%2f) targeting common system file paths such as '/etc/passwd', 'config.tar', or 'system.log' in the access logs.
4. After applying the patch, re-run 'show system status' to confirm the firmware version is 6.0.5 or higher, then restart the SSL VPN service with 'execute vpn ssl reload' and verify connectivity to the portal.

FAQ

References

• https://fortiguard.com/advisory/FG-IR-18-384
• https://www.fortiguard.com/psirt/FG-IR-20-233
• https://fortiguard.com/advisory/FG-IR-18-384
• https://www.fortiguard.com/psirt/FG-IR-20-233
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379