# CVE-2025-62439: Fortinet FortiOS firewall policy bypass in FSSO Terminal Services Agent

Source: https://junglewise.ai/threats/cve-2025-62439-fortinet-fortios-firewall-policy-bypass-in-fsso-terminal-services  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-10. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2025-62439 · Severity: medium · CVSS 4.2 · Published 2026-02-10

A vulnerability in Fortinet's FortiOS operating system, specifically within the Single Sign-On (FSSO) Terminal Services Agent, could allow an authorized user to bypass firewall policies. By sending specifically crafted requests, a user who already has basic access to the system could gain unauthorized access to protected network resources. This could lead to internal security breaches or unauthorized data access within a corporate network.

Technologies: [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios), [Siemens Ruggedcom Ape1808](https://junglewise.ai/threats/technologies/ruggedcom-ape1808). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-62439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62439 being exploited in the wild.

**How severe is CVE-2025-62439?** Medium severity, with a CVSS score of 4.2, published 10 February 2026.

**Which products and versions are affected?** Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions; Siemens Ruggedcom Ape1808 All versions with Fortinet NGFW < V7.4.10.

**Is there a fix for CVE-2025-62439?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-62439 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-62439?** Check whether you run Fortinet FortiOS or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Improper Verification of Source of a Communication Channel vulnerability (CWE-940) exists in the FortiOS FSSO Terminal Services Agent. The flaw allows an authenticated user with knowledge of FSSO policy configurations to bypass intended access controls. By sending crafted requests that exploit the lack of source verification, an attacker can gain unauthorized access to protected network segments. The attack requires local access and low privileges, but has a high complexity due to the requirement of specific configuration knowledge. Fortinet recommends upgrading to FortiOS 7.6.5 or 7.4.10 (upcoming) and updating the FSSO TS Agent to version 5.0 build 0324 or later.

## Affected products

- Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions
- Siemens RUGGEDCOM APE1808 All versions with Fortinet NGFW < V7.4.10

## Timeline

- 2026-02-10: disclosed: Initial publication by Fortinet
- 2026-02-10: advisory: Fortinet advisory FG-IR-25-384 published
- 2026-03-10: advisory: Siemens published advisory SSA-975644 for RUGGEDCOM APE1808

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-25-384](https://fortiguard.fortinet.com/psirt/FG-IR-25-384)
- [https://cert-portal.siemens.com/productcert/html/ssa-975644.html](https://cert-portal.siemens.com/productcert/html/ssa-975644.html)

## Related threats

- [Fortinet FortiOS authentication bypass in HA command execution](https://junglewise.ai/threats/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in)
- [Fortinet FortiOS stack buffer overflow in WAD proxy](https://junglewise.ai/threats/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios)
- [Fortinet FortiOS out-of-bounds read in kernel](https://junglewise.ai/threats/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS path traversal authentication bypass in SSH daemon](https://junglewise.ai/threats/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS numeric truncation error in BGP daemon](https://junglewise.ai/threats/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0)