# Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices (SSA-864900) — Including Actively Exploited FortiCloud SSO Bypass (CVE-2025-59718/-59719) and FortiOS Heap Overflow (CVE-2025-25249)

> Siemens SSA-864900 (v2.0, 2026-08-11) lists 28 CVEs affecting RUGGEDCOM APE1808 industrial edge appliances running Fortigate NGFW below V7.4.9 or V7.6.6. Two of the CVEs — CVE-2025-59718 and CVE-2025-59719, both CVSS 9.8 FortiCloud SSO signature-verification bypasses — are confirmed under active exploitation and listed in CISA's KEV catalog; CVE-2025-25249, a critical unauthenticated FortiOS heap overflow, has also been observed exploited to deploy a post-exploitation RAT.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2486
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-siemens-ruggedcom-fortinet-flaws-tl-2026-2486.webp?v=56188cce (Threadlinqs threat intel: RUGGEDCOM APE1808 Fortinet Flaws: Detection & IOCs (TL-2026-2486) — Critical severity, 10 IOCs, 9 detection rules.)
- **ID:** TL-2026-2486
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10
- **CVEs:** CVE-2024-32122, CVE-2024-50562, CVE-2024-52963, CVE-2024-55599, CVE-2025-22862, CVE-2025-24471, CVE-2025-25248, CVE-2025-25249, CVE-2025-25250, CVE-2025-25253, CVE-2025-31366, CVE-2025-31514, CVE-2025-43892, CVE-2025-47890, CVE-2025-53744, CVE-2025-53843, CVE-2025-53844, CVE-2025-54821, CVE-2025-57740, CVE-2025-58413, CVE-2025-58903, CVE-2025-59718, CVE-2025-59719, CVE-2025-62675, CVE-2025-62826, CVE-2025-67862, CVE-2026-59837, CVE-2026-59840

## Description

Siemens Security Advisory SSA-864900, first published 2025-05-13 and updated to v2.0 on 2026-08-11, documents 28 Fortinet CVEs that carry over to RUGGEDCOM APE1808 — a hardened industrial edge-computing platform deployed at the OT/IT boundary in energy, transportation, and critical-manufacturing networks — because the device runs Fortigate NGFW as its hosted firewall/security application. Devices running Fortinet NGFW below V7.4.9 are affected by 19 of the CVEs; devices below V7.6.6 are affected by 9 of the CVEs. Siemens' remediation is unchanged from typical ICS advisories: apply the vendor firmware update, since Siemens does not independently patch the Fortinet component.

The most severe items in the set are CVE-2025-59718 and CVE-2025-59719 (CVSS 3.1 9.8, CWE-347 Improper Verification of Cryptographic Signature), disclosed by Fortinet on 2025-12-09 under PSIRT advisory FG-IR-25-647. Both allow an unauthenticated attacker to submit a crafted SAML response message that the device's FortiCloud SSO login flow fails to properly validate, granting administrative access without credentials. CVE-2025-59718 affects FortiOS, FortiProxy, and FortiSwitchManager; CVE-2025-59719 affects FortiWeb. Although FortiCloud SSO is disabled in factory defaults, Arctic Wolf and Rapid7 note it is silently re-enabled when a device is registered to FortiCare via the GUI unless an administrator explicitly opts out — a significant real-world exposure driver. Arctic Wolf observed malicious SSO logins beginning 2025-12-12, CISA added CVE-2025-59718 to its KEV catalog on 2025-12-16, and Rapid7 confirmed broad in-the-wild exploitation against internet-exposed FortiGate devices by 2026-01-16. Post-compromise, attackers consistently authenticate as admin and immediately download the device's system configuration file, which contains hashed local credentials for further lateral movement or offline cracking.

CVE-2025-25249 (Siemens-listed CVSS 3.1 8.1; independently tracked by NVD/CISA partners at up to 9.8, CWE-122 Heap-Based Buffer Overflow, Fortinet PSIRT FG-IR-25-084) is a remotely triggerable, unauthenticated heap overflow in the FortiOS/FortiSwitchManager cw_acd daemon reachable via crafted packets, and is also listed in CISA's KEV catalog as actively exploited. SOCRadar reports exploitation of this flaw has been used to deploy "PivotC2," a FortiGate-targeting post-exploitation RAT.

A cluster of memory-corruption CVEs (CVE-2025-53843 stack overflow in the capwap daemon, FG-IR-25-358, CVSS 7.5; CVE-2025-53844 out-of-bounds write in capwap, FG-IR-26-123, CVSS 8.8; CVE-2025-58413 unauthenticated stack overflow in wireless-controller packet processing, CVSS 7.5; CVE-2026-59837 privileged stack overflow, CVSS 6.6) let an attacker controlling — or spoofing — a Security-Fabric-connected FortiAP, FortiSwitch, or FortiExtender execute code on the parent FortiGate, which is directly relevant to RUGGEDCOM APE1808 deployments that federate multiple fabric-connected devices at OT network edges. Separately, CVE-2025-53744 (FG-IR-25-173, CWE-266, CVSS 7.2) lets an authenticated high-privilege admin escalate to super-admin by registering the FortiGate to a malicious FortiManager instance, abusing the implicit trust relationship in Security Fabric registration.

The remaining 21 CVEs are lower-severity issues spanning certificate-validation weaknesses (CVE-2025-24471 accepts revoked certificates; CVE-2025-25253 certificate host mismatch in the ZTNA proxy — both enabling adversary-in-the-middle positioning), information disclosure (CVE-2025-25250 SSL-VPN settings exposure via crafted URL; CVE-2025-43892 and CVE-2026-59840 buffer over-reads; CVE-2025-31514 2FA data in logs), input-validation bugs (CVE-2025-31366 reflected XSS; CVE-2025-62675/CVE-2025-62826 HTTP response splitting; CVE-2025-47890 open redirect; CVE-2025-25248 integer overflow in SSL-VPN bookmarks), a CLI scripting-engine issue (CVE-2025-67862, CWE-1244, Lua script execution via CLI), a DNS-filter bypass (CVE-2024-55599), a session-management flaw (CVE-2024-50562), a trusted-host-policy bypass (CVE-2025-54821), a null-pointer DoS (CVE-2025-58903), and an IPsec out-of-bounds write DoS (CVE-2024-52963).

No public exploitation or PoC is stated for the RUGGEDCOM-specific advisory itself, but several of the underlying Fortinet CVEs (CVE-2025-59718, CVE-2025-59719, CVE-2025-25249) are independently confirmed as actively exploited in the wild against FortiGate deployments generally, which raises material risk for any RUGGEDCOM APE1808 unit left on an unpatched Fortigate NGFW branch.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1059.008 Network Device CLI
- T1059.007 JavaScript
- T1556 Modify Authentication Process
- T1552.001 Credentials In Files
- T1552 Unsecured Credentials
- T1557 Adversary-in-the-Middle
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**FortiCloud SSO SAML Signature-Bypass Administrative Login (CVE-2025-59718 / CVE-2025-59719)** (`TL-2026-2486-SPL-001`)

Detects a super_admin/prof_admin FortiGate/FortiWeb login authenticated via the FortiCloud SSO path where no corresponding successful local-auth event precedes it. CVE-2025-59718/-59719 (CWE-347) let an unauthenticated attacker submit a crafted SAML response that FortiOS/FortiProxy/FortiSwitchManager/FortiWeb fail to signature-verify, granting instant admin access. Arctic Wolf/Rapid7 confirm this pattern in the wild against internet-exposed appliances.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1556
- **Data sources:** fortigate_event, fortigate_utm, CommonSecurityLog (CEF firewall ingest)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
`comment("CVE-2025-59718/-59719: admin-level login via FortiCloud SSO with no preceding local password auth for the same admin/session")`
index=network sourcetype=fortigate_event (subtype=system OR subtype=vpn) logdesc="Administrator logged in successfully" OR action="login"
| eval auth_method=coalesce(method, authtype, ui)
| where match(auth_method, "(?i)sso|forticloud")
| eval admin_level=if(match(profile, "(?i)super_admin|prof_admin|admin"), 1, 0)
| where admin_level=1
| eval sess_key=dvc."|".user
| join type=left sess_key
    [ search index=network sourcetype=fortigate_event subtype=system action="login" NOT (match(method,"(?i)sso|forticloud"))
      | eval sess_key=dvc."|".user
      | stats count as local_auth_count by sess_key ]
| where isnull(local_auth_count) OR local_auth_count=0
| stats count min(_time) as first_seen max(_time) as last_seen values(srcip) as src_ips values(user) as admin_users by dvc, tenant
| where count>0
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
// CVE-2025-59718/-59719: FortiCloud SSO admin login with no matching local-auth event in the trailing 24h
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Fortinet"
| where DeviceEventClassID in ("0100032001", "login") or Activity has "logged in successfully"
| extend AuthMethod = tostring(AdditionalExtensions["method"])
| where AuthMethod has_any ("sso", "forticloud") or Message has_any ("sso", "forticloud")
| extend AdminProfile = tostring(AdditionalExtensions["profile"])
| where AdminProfile has_any ("super_admin", "prof_admin", "admin")
| extend SessionKey = strcat(DeviceName, "|", DestinationUserName)
| join kind=leftanti (
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceVendor == "Fortinet"
    | where Activity has "logged in successfully"
    | where AdditionalExtensions["method"] !has_any ("sso", "forticloud")
    | extend SessionKey = strcat(DeviceName, "|", DestinationUserName)
) on SessionKey
| project TimeGenerated, DeviceName, DestinationUserName, SourceIP, AdminProfile, AuthMethod
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Logins=count() by DeviceName, DestinationUserName, SourceIP
```

### Sigma

```yaml
title: FortiCloud SSO SAML Signature-Bypass Admin Login
id: 7a1c2e44-3f6b-4d2a-9b1e-1a2b3c4d5e01
status: experimental
description: Detects an administrator-level FortiGate/FortiProxy/FortiSwitchManager/FortiWeb login authenticated via FortiCloud SSO where the crafted SAML response bypasses signature verification (CVE-2025-59718, CVE-2025-59719), granting unauthenticated admin access.
references:
    - https://fortiguard.fortinet.com/psirt/FG-IR-25-647
    - https://arcticwolf.com/resources/blog/cve-2025-59718-and-cve-2025-59719/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1556
    - cve.2025.59718
    - cve.2025.59719
    - attack.tool.forticloud_sso_bypass
logsource:
    category: firewall
    product: fortios
detection:
    selection_login:
        subtype: 'system'
        action: 'login'
        method|contains:
            - 'sso'
            - 'forticloud'
    selection_admin:
        profile|contains:
            - 'super_admin'
            - 'prof_admin'
            - 'admin'
    condition: selection_login and selection_admin
falsepositives:
    - Legitimate SSO logins from newly onboarded FortiCloud-registered administrators during a planned rollout
level: critical
```

**Known false positives:**

- Legitimate SSO logins from newly onboarded FortiCloud-registered admins during a planned rollout or migration

**Tuning notes:** Baseline the documented FortiCloud tenant IDs and management-network source ranges; suppress on devices with FortiCloud SSO explicitly enabled by change-control, and raise severity when the admin profile is super_admin or the source IP is outside the management allowlist.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Security Fabric Registration to Untrusted FortiManager Enabling Super-Admin Escalation (CVE-2025-53744) (locked: unlock with TL Creds)
- Post-Compromise Network Device CLI / Lua Scripting-Engine Abuse (CVE-2025-67862) (locked: unlock with TL Creds)
- Rogue Fabric-Connected Device (FortiAP/FortiSwitch/FortiExtender) capwap Overflow Triggering Code Execution on Parent FortiGate (locked: unlock with TL Creds)
- Crafted SAML Response Submitted to FortiCloud SSO Login Endpoint (locked: unlock with TL Creds)
- SSL-VPN Certificate Validation Bypass Enabling AiTM Positioning (CVE-2025-24471 / CVE-2025-25253) (locked: unlock with TL Creds)
- Fabric-Wide Lateral Spread Signature Following Rogue-Device Trust Abuse (locked: unlock with TL Creds)
- System Configuration Export Immediately Following Unauthenticated Admin Session (locked: unlock with TL Creds)
- PivotC2 Post-Exploitation RAT Beacon Following cw_acd Heap Overflow (CVE-2025-25249) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [SSA-864900: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices](https://cert-portal.siemens.com/productcert/html/ssa-864900.html)
- [FG-IR-25-647: FortiCloud SSO Login Authentication Bypass](https://fortiguard.fortinet.com/psirt/FG-IR-25-647)
- [FG-IR-25-084: Authenticated Heap Overflow in SSL-VPN bookmarks / cw_acd](https://fortiguard.fortinet.com/psirt/FG-IR-25-084)
- [FG-IR-25-173: FortiOS Security Fabric Privilege Escalation](https://www.fortiguard.com/psirt/FG-IR-25-173)
- [FG-IR-25-358: FortiOS capwap Stack Buffer Overflow](https://www.rapid7.com/db/vulnerabilities/fortios-cve-2025-53843/)
- [FG-IR-26-123: FortiOS capwap Out-of-Bounds Write](https://fortiguard.fortinet.com/psirt/FG-IR-26-123)
- [AL25-019: Vulnerabilities impacting Fortinet products — FortiCloud SSO Login Authentication Bypass — Update 2](https://www.cyber.gc.ca/en/alerts-advisories/al25-019-vulnerabilities-impacting-fortinet-products-forticloud-sso-login-authentication-bypass-cve-2025-59718-cve-2025-59719)
- [Critical vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719 exploited in the wild](https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-fortinet-cve-2025-59718-cve-2025-59719-exploited-in-the-wild/)
- [CVE-2025-59718 and CVE-2025-59719](https://arcticwolf.com/resources/blog/cve-2025-59718-and-cve-2025-59719/)
- [FortiCloud SSO Login Bypass Vulnerabilities Exploited in the Wild](https://www.vulncheck.com/blog/forticloud-sso-login-bypass)
- [CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT](https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2025-25249](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249)
- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2025-59718)](https://www.cisa.gov/news-events/alerts/2025/12/16/cisa-adds-one-known-exploited-vulnerability-catalog)
- [Siemens RUGGEDCOM APE1808 Devices (ICSA-26-071-02, follow-on advisory)](https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-02)
- [ICS Patch Tuesday: Siemens Ruggedcom Devices Impacted by 45 Fortinet Vulnerabilities](https://www.securityweek.com/ics-patch-tuesday-siemens-ruggedcom-devices-impacted-by-45-fortinet-vulnerabilities/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2486