# CVE-2025-53844: Fortinet FortiOS out-of-bounds write via crafted packets

Source: https://junglewise.ai/threats/cve-2025-53844-fortinet-fortios-out-of-bounds-write-via-crafted-packets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-53844 · Severity: high · CVSS 8.8 · Published 2026-05-12

FortiOS is the operating system used by Fortinet security devices, such as firewalls, to manage network traffic and security policies. A vulnerability in this software could allow an attacker to send malicious network traffic to the device to gain unauthorized control. If exploited, this could lead to the execution of unauthorized commands, potentially compromising the security of the entire network or leading to data theft and service disruptions.

Technologies: [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios), [Siemens Ruggedcom Ape1808](https://junglewise.ai/threats/technologies/ruggedcom-ape1808). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-53844 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-53844 being exploited in the wild.

**How severe is CVE-2025-53844?** High severity, with a CVSS score of 8.8, published 12 May 2026.

**Which products and versions are affected?** Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11; Siemens Ruggedcom Ape1808 Versions with Fortinet NGFW < V7.6.6.

**Is there a fix for CVE-2025-53844?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-53844 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-53844?** Check whether you run Fortinet FortiOS or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in Fortinet FortiOS versions 7.6.0-7.6.3, 7.4.0-7.4.8, and 7.2.0-7.2.11. The flaw is triggered by the processing of specially crafted packets sent over the network. An attacker with low-level authentication (PR:L) can exploit this to achieve arbitrary code execution or unauthorized command execution on the underlying system. The vulnerability also impacts Siemens RUGGEDCOM APE1808 devices running affected Fortinet NGFW versions. Patches are available in FortiOS versions 7.6.6, 7.4.9, and 7.2.12.

## Affected products

- Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11
- Siemens RUGGEDCOM APE1808 (Fortinet NGFW) Versions with Fortinet NGFW < V7.6.6

## Timeline

- 2025-05-13: advisory: Initial Siemens advisory publication
- 2026-05-12: disclosed: NVD publication date
- 2026-06-09: other: Last modified date for NVD and Siemens records

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-123](https://fortiguard.fortinet.com/psirt/FG-IR-26-123)
- [https://cert-portal.siemens.com/productcert/html/ssa-864900.html](https://cert-portal.siemens.com/productcert/html/ssa-864900.html)

## Related threats

- [Fortinet FortiOS authentication bypass in HA command execution](https://junglewise.ai/threats/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in)
- [Fortinet FortiOS stack buffer overflow in WAD proxy](https://junglewise.ai/threats/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios)
- [Fortinet FortiOS out-of-bounds read in kernel](https://junglewise.ai/threats/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS path traversal authentication bypass in SSH daemon](https://junglewise.ai/threats/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS numeric truncation error in BGP daemon](https://junglewise.ai/threats/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0)