Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices (SSA-864900) — Including Actively Exploited FortiCloud SSO Bypass (CVE-2025-59718/-59719) and FortiOS Heap Overflow (CVE-2025-25249)

Key facts for Siemens RUGGEDCOM Fortinet flaws

Detection coverage for Siemens RUGGEDCOM Fortinet flaws

As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2486 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FortiCloud SSO SAML Signature-Bypass Administrative Login (CVE-2025-59718 / CVE-2025-59719)

Detects a super_admin/prof_admin FortiGate/FortiWeb login authenticated via the FortiCloud SSO path where no corresponding successful local-auth event precedes it. CVE-2025-59718/-59719 (CWE-347) let an unauthenticated attacker submit a crafted SAML response that FortiOS/FortiProxy/FortiSwitchManager/FortiWeb fail to signature-verify, granting instant admin access. Arctic Wolf/Rapid7 confirm this pattern in the wild against internet-exposed appliances.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1556
• Data sources: fortigate_event, fortigate_utm, CommonSecurityLog (CEF firewall ingest)
• Severity: critical
• Confidence: high

Splunk SPL

`comment("CVE-2025-59718/-59719: admin-level login via FortiCloud SSO with no preceding local password auth for the same admin/session")`
index=network sourcetype=fortigate_event (subtype=system OR subtype=vpn) logdesc="Administrator logged in successfully" OR action="login"
| eval auth_method=coalesce(method, authtype, ui)
| where match(auth_method, "(?i)sso|forticloud")
| eval admin_level=if(match(profile, "(?i)super_admin|prof_admin|admin"), 1, 0)
| where admin_level=1
| eval sess_key=dvc."|".user
| join type=left sess_key
    [ search index=network sourcetype=fortigate_event subtype=system action="login" NOT (match(method,"(?i)sso|forticloud"))
      | eval sess_key=dvc."|".user
      | stats count as local_auth_count by sess_key ]
| where isnull(local_auth_count) OR local_auth_count=0
| stats count min(_time) as first_seen max(_time) as last_seen values(srcip) as src_ips values(user) as admin_users by dvc, tenant
| where count>0
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// CVE-2025-59718/-59719: FortiCloud SSO admin login with no matching local-auth event in the trailing 24h
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Fortinet"
| where DeviceEventClassID in ("0100032001", "login") or Activity has "logged in successfully"
| extend AuthMethod = tostring(AdditionalExtensions["method"])
| where AuthMethod has_any ("sso", "forticloud") or Message has_any ("sso", "forticloud")
| extend AdminProfile = tostring(AdditionalExtensions["profile"])
| where AdminProfile has_any ("super_admin", "prof_admin", "admin")
| extend SessionKey = strcat(DeviceName, "|", DestinationUserName)
| join kind=leftanti (
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceVendor == "Fortinet"
    | where Activity has "logged in successfully"
    | where AdditionalExtensions["method"] !has_any ("sso", "forticloud")
    | extend SessionKey = strcat(DeviceName, "|", DestinationUserName)
) on SessionKey
| project TimeGenerated, DeviceName, DestinationUserName, SourceIP, AdminProfile, AuthMethod
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Logins=count() by DeviceName, DestinationUserName, SourceIP

Sigma

title: FortiCloud SSO SAML Signature-Bypass Admin Login
id: 7a1c2e44-3f6b-4d2a-9b1e-1a2b3c4d5e01
status: experimental
description: Detects an administrator-level FortiGate/FortiProxy/FortiSwitchManager/FortiWeb login authenticated via FortiCloud SSO where the crafted SAML response bypasses signature verification (CVE-2025-59718, CVE-2025-59719), granting unauthenticated admin access.
references:
    - https://fortiguard.fortinet.com/psirt/FG-IR-25-647
    - https://arcticwolf.com/resources/blog/cve-2025-59718-and-cve-2025-59719/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1556
    - cve.2025.59718
    - cve.2025.59719
    - attack.tool.forticloud_sso_bypass
logsource:
    category: firewall
    product: fortios
detection:
    selection_login:
        subtype: 'system'
        action: 'login'
        method|contains:
            - 'sso'
            - 'forticloud'
    selection_admin:
        profile|contains:
            - 'super_admin'
            - 'prof_admin'
            - 'admin'
    condition: selection_login and selection_admin
falsepositives:
    - Legitimate SSO logins from newly onboarded FortiCloud-registered administrators during a planned rollout
level: critical

Known false positives:

• Legitimate SSO logins from newly onboarded FortiCloud-registered admins during a planned rollout or migration

Tuning notes: Baseline the documented FortiCloud tenant IDs and management-network source ranges; suppress on devices with FortiCloud SSO explicitly enabled by change-control, and raise severity when the admin profile is super_admin or the source IP is outside the management allowlist.

• 🔒 Security Fabric Registration to Untrusted FortiManager Enabling Super-Admin Escalation (CVE-2025-53744) · unlock with TL Creds
• 🔒 Post-Compromise Network Device CLI / Lua Scripting-Engine Abuse (CVE-2025-67862) · unlock with TL Creds
• 🔒 Rogue Fabric-Connected Device (FortiAP/FortiSwitch/FortiExtender) capwap Overflow Triggering Code Execution on Parent FortiGate · unlock with TL Creds
• 🔒 Crafted SAML Response Submitted to FortiCloud SSO Login Endpoint · unlock with TL Creds
• 🔒 SSL-VPN Certificate Validation Bypass Enabling AiTM Positioning (CVE-2025-24471 / CVE-2025-25253) · unlock with TL Creds
• 🔒 Fabric-Wide Lateral Spread Signature Following Rogue-Device Trust Abuse · unlock with TL Creds
• 🔒 System Configuration Export Immediately Following Unauthenticated Admin Session · unlock with TL Creds
• 🔒 PivotC2 Post-Exploitation RAT Beacon Following cw_acd Heap Overflow (CVE-2025-25249) · unlock with TL Creds

Indicators of compromise for Siemens RUGGEDCOM Fortinet flaws

As of 2026-09-13, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-2486.

How Siemens RUGGEDCOM Fortinet flaws works

Siemens Security Advisory SSA-864900, first published 2025-05-13 and updated to v2.0 on 2026-08-11, documents 28 Fortinet CVEs that carry over to RUGGEDCOM APE1808 — a hardened industrial edge-computing platform deployed at the OT/IT boundary in energy, transportation, and critical-manufacturing networks — because the device runs Fortigate NGFW as its hosted firewall/security application. Devices running Fortinet NGFW below V7.4.9 are affected by 19 of the CVEs; devices below V7.6.6 are affected by 9 of the CVEs. Siemens' remediation is unchanged from typical ICS advisories: apply the vendor firmware update, since Siemens does not independently patch the Fortinet component.

The most severe items in the set are CVE-2025-59718 and CVE-2025-59719 (CVSS 3.1 9.8, CWE-347 Improper Verification of Cryptographic Signature), disclosed by Fortinet on 2025-12-09 under PSIRT advisory FG-IR-25-647. Both allow an unauthenticated attacker to submit a crafted SAML response message that the device's FortiCloud SSO login flow fails to properly validate, granting administrative access without credentials. CVE-2025-59718 affects FortiOS, FortiProxy, and FortiSwitchManager; CVE-2025-59719 affects FortiWeb. Although FortiCloud SSO is disabled in factory defaults, Arctic Wolf and Rapid7 note it is silently re-enabled when a device is registered to FortiCare via the GUI unless an administrator explicitly opts out — a significant real-world exposure driver. Arctic Wolf observed malicious SSO logins beginning 2025-12-12, CISA added CVE-2025-59718 to its KEV catalog on 2025-12-16, and Rapid7 confirmed broad in-the-wild exploitation against internet-exposed FortiGate devices by 2026-01-16. Post-compromise, attackers consistently authenticate as admin and immediately download the device's system configuration file, which contains hashed local credentials for further lateral movement or offline cracking.

CVE-2025-25249 (Siemens-listed CVSS 3.1 8.1; independently tracked by NVD/CISA partners at up to 9.8, CWE-122 Heap-Based Buffer Overflow, Fortinet PSIRT FG-IR-25-084) is a remotely triggerable, unauthenticated heap overflow in the FortiOS/FortiSwitchManager cw_acd daemon reachable via crafted packets, and is also listed in CISA's KEV catalog as actively exploited. SOCRadar reports exploitation of this flaw has been used to deploy "PivotC2," a FortiGate-targeting post-exploitation RAT.

A cluster of memory-corruption CVEs (CVE-2025-53843 stack overflow in the capwap daemon, FG-IR-25-358, CVSS 7.5; CVE-2025-53844 out-of-bounds write in capwap, FG-IR-26-123, CVSS 8.8; CVE-2025-58413 unauthenticated stack overflow in wireless-controller packet processing, CVSS 7.5; CVE-2026-59837 privileged stack overflow, CVSS 6.6) let an attacker controlling — or spoofing — a Security-Fabric-connected FortiAP, FortiSwitch, or FortiExtender execute code on the parent FortiGate, which is directly relevant to RUGGEDCOM APE1808 deployments that federate multiple fabric-connected devices at OT network edges. Separately, CVE-2025-53744 (FG-IR-25-173, CWE-266, CVSS 7.2) lets an authenticated high-privilege admin escalate to super-admin by registering the FortiGate to a malicious FortiManager instance, abusing the implicit trust relationship in Security Fabric registration.

The remaining 21 CVEs are lower-severity issues spanning certificate-validation weaknesses (CVE-2025-24471 accepts revoked certificates; CVE-2025-25253 certificate host mismatch in the ZTNA proxy — both enabling adversary-in-the-middle positioning), information disclosure (CVE-2025-25250 SSL-VPN settings exposure via crafted URL; CVE-2025-43892 and CVE-2026-59840 buffer over-reads; CVE-2025-31514 2FA data in logs), input-validation bugs (CVE-2025-31366 reflected XSS; CVE-2025-62675/CVE-2025-62826 HTTP response splitting; CVE-2025-47890 open redirect; CVE-2025-25248 integer overflow in SSL-VPN bookmarks), a CLI scripting-engine issue (CVE-2025-67862, CWE-1244, Lua script execution via CLI), a DNS-filter bypass (CVE-2024-55599), a session-management flaw (CVE-2024-50562), a trusted-host-policy bypass (CVE-2025-54821), a null-pointer DoS (CVE-2025-58903), and an IPsec out-of-bounds write DoS (CVE-2024-52963).

No public exploitation or PoC is stated for the RUGGEDCOM-specific advisory itself, but several of the underlying Fortinet CVEs (CVE-2025-59718, CVE-2025-59719, CVE-2025-25249) are independently confirmed as actively exploited in the wild against FortiGate deployments generally, which raises material risk for any RUGGEDCOM APE1808 unit left on an unpatched Fortigate NGFW branch.

MITRE ATT&CK techniques by tactic:

Execution

T1059.007 JavaScript; T1059.008 Network Device CLI

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Impact

T1499.004 Application or System Exploitation

Credential Access

T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1557 Adversary-in-the-Middle

defense-impairment

T1556 Modify Authentication Process

Remediation for Siemens RUGGEDCOM Fortinet flaws

Patches

• Fortinet PSIRT FG-IR-25-647 — CVE-2025-59718, CVE-2025-59719
• Fortinet PSIRT FG-IR-25-084 — CVE-2025-25249
• Fortinet PSIRT FG-IR-25-173 — CVE-2025-53744
• Fortinet PSIRT FG-IR-25-358 — CVE-2025-53843
• Fortinet PSIRT FG-IR-26-123 — CVE-2025-53844
• Siemens SSA-864900 v2.0 — update Fortigate NGFW to V7.4.9+ or V7.6.6+

Immediate actions

• Update Fortigate NGFW on RUGGEDCOM APE1808 to V7.4.9+ (V7.4.10+ per the follow-on ICSA-26-071-02 guidance) or V7.6.6+ depending on the affected range
• Disable the FortiCloud SSO login feature until patched, and explicitly opt out of its auto-enable during FortiCare device registration (CVE-2025-59718, CVE-2025-59719)
• Restrict Security Fabric registration to trusted, pinned FortiManager instances only and audit recent fabric registration events (CVE-2025-53744)
• Treat any device that logged an unexpected FortiCloud SSO admin session as compromised: rotate all local credentials and re-issue certificates, since attackers download and can crack the hashed credentials in the exported configuration

Workarounds

• Disable the wireless-controller/capwap daemon if FortiAP/FortiSwitch management is not required (CVE-2025-53844, CVE-2025-58413)
• Configure IPsec phase1-interface with psk authentication or disable digital-signature-auth (CVE-2024-52963)
• Remove Security Fabric access from untrusted interfaces (CVE-2025-25249 mitigation per Fortinet PSIRT)

Longer-term hardening

• Adopt Siemens' Operational Guidelines for Industrial Security for all RUGGEDCOM APE1808 deployments
• Segment the OT/IT boundary so FortiGate management interfaces on RUGGEDCOM APE1808 are never internet-exposed
• Continuously monitor CISA's KEV catalog and Fortinet PSIRT advisories (FG-IR-25-647, FG-IR-25-084, FG-IR-25-173, FG-IR-25-358, FG-IR-26-123) for this platform
• Require mutual authentication / certificate pinning between Security-Fabric-connected FortiAP, FortiSwitch, FortiExtender, and FortiManager devices to reduce the capwap/fabric-trust attack surface

Affected and fixed versions

• Siemens — RUGGEDCOM APE1808 (running Fortigate NGFW)
  Vulnerable versions: all versions with Fortinet NGFW < V7.4.9; all versions with Fortinet NGFW < V7.6.6
  Fixed in: Fortinet NGFW V7.4.9 or later (V7.4.10+ recommended); Fortinet NGFW V7.6.6 or later
• Fortinet — FortiOS
  Vulnerable versions: 6.0; 6.2; 6.4; 7.0.0-7.0.17; 7.2.0-7.2.11; 7.4.0-7.4.9; 7.6.0-7.6.4
  Fixed in: 7.4.9+ / 7.4.10+; 7.6.6+
• Fortinet — FortiProxy
  Vulnerable versions: versions predating FG-IR-25-647 fixed builds
  Fixed in: per FG-IR-25-647
• Fortinet — FortiSwitchManager
  Vulnerable versions: 7.0.0-7.0.5; 7.2.0-7.2.6
  Fixed in: per FG-IR-25-647 / FG-IR-25-084
• Fortinet — FortiWeb
  Vulnerable versions: 7.4.0-7.4.9; 7.6.0-7.6.4; 8.0.0
  Fixed in: per FG-IR-25-647
• Fortinet — FortiSASE
  Vulnerable versions: 25.3.b
  Fixed in: per FG-IR-25-... CVE-2025-58413 remediation

Timeline of Siemens RUGGEDCOM Fortinet flaws

• 2025-05-13 locked-ioc-7 ProductCERT first publishes SSA-864900 covering locked-ioc-5 CVEs affecting locked-ioc-2 devices running Fortigate NGFW.
• 2025-12-09 locked-ioc-5 discloses CVE-2025-59718 and CVE-2025-59719 (FortiCloud SSO signature-verification bypass) under PSIRT advisory FG-IR-25-647, alongside CVE-2025-25249 (FG-IR-25-084) and CVE-2025-53744 (FG-IR-25-173).
• 2025-12-12 Arctic Wolf observes malicious FortiCloud SSO admin logins on internet-facing FortiGate appliances, days after CVE-2025-59718/-59719 disclosure.
• 2025-12-16 locked-ioc-10 adds CVE-2025-59718 to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation.
• 2025-12-17 Rapid7 observes exploitation attempts against honeypots; non-functional public PoC exploit code for CVE-2025-59718 begins circulating on GitHub.
• 2025-12-18 VulnCheck analysis finds the two public CVE-2025-59718 PoCs circulating at the time are fake or non-functional.
• 2026-01-16 Rapid7 confirms broad active exploitation of CVE-2025-59718/-59719 against internet-exposed FortiGate devices.
• 2026-08-11 locked-ioc-7 updates SSA-864900 to v2.0, expanding the enumerated CVE set to 28 entries affecting locked-ioc-2 devices running Fortigate NGFW below V7.4.9 or V7.6.6.

Sources cited for Siemens RUGGEDCOM Fortinet flaws

Showing 15 of 17 sources, primary sources first.

• SSA-864900: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices cert-portal.siemens.com · Advisory · 2026-08-11
• FG-IR-25-647: FortiCloud SSO Login Authentication Bypass Fortinet · Advisory · 2025-12-09
• FG-IR-25-084: Authenticated Heap Overflow in SSL-VPN bookmarks / cw_acd Fortinet · Advisory · 2025-12-09
• FG-IR-25-173: FortiOS Security Fabric Privilege Escalation FortiGuard Labs · Advisory · 2025-12-09
• FG-IR-25-358: FortiOS capwap Stack Buffer Overflow Rapid7 · Advisory · 2025-12-09
• FG-IR-26-123: FortiOS capwap Out-of-Bounds Write Fortinet · Advisory · 2026-01-13
• AL25-019: Vulnerabilities impacting Fortinet products — FortiCloud SSO Login Authentication Bypass — Update 2 cyber.gc.ca · Advisory · 2025-12-16
• CISA Known Exploited Vulnerabilities Catalog — CVE-2025-25249 CISA · Government advisory · 2026-09-13
• CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2025-59718) CISA · Government advisory · 2025-12-16
• Siemens RUGGEDCOM APE1808 Devices (ICSA-26-071-02, follow-on advisory) CISA · Government advisory · 2026-03-12
• CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT socradar.io · Research · 2026-01-01
• NVD — CVE-2025-59718 NVD (NIST) · Research · 2025-12-09
• NVD — CVE-2025-59719 NVD (NIST) · Research · 2025-12-09
• Critical vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719 exploited in the wild Rapid7 · Blog · 2026-01-16
• CVE-2025-59718 and CVE-2025-59719 arcticwolf.com · Blog · 2025-12-12

More in vulnerability

• Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library
• CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library
• D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)
• Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10
• Apple September 2026 Security Updates: 273 CVEs incl. actively exploited Screen Sharing auth bypass (CVE-2026-65400) and critical Bluetooth RCE (CVE-2026-65414)