---
title: "SECURITY ALERT: Multiple Fortinet Operating System Vulnerabilities"
description: Systems Engineering releases patching guidance for the Multiple Fortinet Operating System Vulnerabilities.  April 2021.
---

[IT and Cybersecurity News](https://blog.systemsengineering.com/blog)

# [SECURITY ALERT: Multiple Fortinet Operating System Vulnerabilities](https://blog.systemsengineering.com/blog/security-alert-040621-multiple-fortinet-operating-system-vulnerabilities)

 Written by [Systems Engineering](https://blog.systemsengineering.com/blog/author/systems-engineering) | April 06, 2021

Systems Engineering is aware of the [FBI and CISA joint security advisory](https://www.ic3.gov/Media/News/2021/210402.pdf) indicating threat actors are potentially using multiple Common Vulnerabilities and Exposures (CVE) to exploit Fortinet operating systems, known as FortiOS. The advisory calls out three vulnerabilities that may be used to gain access to business networks to begin data exfiltration or data encryption attacks. Vulnerabilities include;

| VULNERABILITY | RISK | CVE ID |
| --- | --- | --- |
| **FortiOS SSL VPN’s web portal** May allow an unauthorized attacker to download FortiOS system files. | HIGH | [CVE-2018-13379](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13379) |
| **FortiOS SSL VPN FortiToken** May allow authentication bypass of two-factor authentication when changing the case of username. An attacker would need user credentials (username & password) to access the SSL VPN.  | MEDIUM | [CVE-2020-12812](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12812) |
| **FortiOS LDAP Server**  May allow an unauthorized attacker on the same IP subnet to intercept sensitive information by impersonating the LDAP server. | MEDIUM | [CVE-2019-5591](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5591) |

### Course of Action

We recommend that all Systems Engineering clients patch their FortiOS for these vulnerabilities. [SE EventWatch](https://www.systemsengineering.com/security/detection-and-response/)® and [SE Essentials](https://www.systemsengineering.com/managed-it/it-essentials/) managed services clients had the high-risk vulnerability (CVE-2018-13379) patched when the security update became available. Currently, we are proactively working with these services clients to address the two medium-risk vulnerabilities (CVE-2020-12812 and CVE-2019-5591.)

If you are a client not covered under one of the previously mentioned services and would like assistance with patching your FortiOS, please reach out to our Customer Service team at 207.772.4199 to schedule a FortiOS security patch ticket.

For all clients, please contact your Account Manager with any questions regarding these FortiOS vulnerabilities.

[View full post](https://blog.systemsengineering.com/blog/security-alert-040621-multiple-fortinet-operating-system-vulnerabilities)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Systems Engineering"
  },
  "dateModified" : "2023-01-09T16:14:17.877Z",
  "datePublished" : "2021-04-06T14:21:55Z",
  "headline" : "SECURITY ALERT: Multiple Fortinet Operating System Vulnerabilities",
  "image" : {
    "@type" : "ImageObject",
    "height" : 350,
    "url" : "https://f.hubspotusercontent30.net/hubfs/508286/Security%20Alert_Systems%20Engineering.png",
    "width" : 600
  },
  "mainEntityOfPage" : "https://blog.systemsengineering.com/blog/security-alert-040621-multiple-fortinet-operating-system-vulnerabilities",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/508286/Systems%20Engineering%20Logo_2019_Color_100x100px-4.png",
      "width" : 66.92957
    },
    "name" : "<span>Systems Engineering</span> Blog"
  }
}
```