CVE-2018-13374

Fortinet FortiOS and FortiADC allowed attackers to steal LDAP credentials by redirecting connectivity test requests to a rogue server.

This improper access control flaw exposed LDAP server login credentials, enabling attackers to impersonate legitimate users or escalate privileges. DIB organizations must ensure LDAP configurations are protected from redirection attacks and verify vendor patching timelines for critical infrastructure.

Shame score — A critical, actively exploited vulnerability in core Fortinet products that directly enabled credential theft and ransomware-linked attacks, reflecting a severe avoidable failure in access control design.