Is CVE-2025-64157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64157 being exploited in the wild.

How severe is CVE-2025-64157?

Medium severity, with a CVSS score of 6.7, published 10 February 2026.

Which products and versions are affected?

Fortinet FortiGate NGFW Versions with FortiOS < 7.4.10; Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, 7.0 all versions; Siemens Ruggedcom Ape1808 Versions with FortiOS < 7.4.10.

Is there a fix for CVE-2025-64157?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-64157 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2025-64157?

Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64157: Fortinet FortiOS format string vulnerability in CAPWAP fast-failover mode

Q: Is there a fix for CVE-2025-64157?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-64157 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2025-64157?

Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64157 · Severity: medium · CVSS 6.7 · Published 2026-02-10

A vulnerability in Fortinet's FortiOS operating system, used in FortiGate firewalls and Siemens industrial application platforms, could allow an administrator to execute unauthorized commands. By providing a specially crafted configuration, a user with high-level access can bypass intended security restrictions to run arbitrary code. This could lead to a full compromise of the device's integrity and availability, though it requires the attacker to already have administrative credentials.

Technologies: Fortinet FortiGate NGFW, Fortinet FortiOS, Siemens Ruggedcom Ape1808. Vendors: Fortinet, Siemens.

Quick answers

Is CVE-2025-64157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64157 being exploited in the wild.
How severe is CVE-2025-64157?: Medium severity, with a CVSS score of 6.7, published 10 February 2026.
Which products and versions are affected?: Fortinet FortiGate NGFW Versions with FortiOS < 7.4.10; Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, 7.0 all versions; Siemens Ruggedcom Ape1808 Versions with FortiOS < 7.4.10.
Is there a fix for CVE-2025-64157?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-64157 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2025-64157?: Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Use of Externally-Controlled Format String vulnerability (CWE-134) exists in the CAPWAP fast-failover mode component of FortiOS. The flaw is accessible via the Command Line Interface (CLI) and is triggered when the system processes specifically crafted configuration data. An attacker with administrative privileges can exploit this to achieve arbitrary code execution on the underlying operating system. The vulnerability affects multiple major versions of FortiOS (7.0, 7.2, 7.4, and 7.6) and is also present in Siemens RUGGEDCOM APE1808 devices running affected FortiOS versions. Patches are available in FortiOS 7.6.5, 7.4.10, and subsequent releases.

Affected products

Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, 7.0 all versions
Siemens RUGGEDCOM APE1808 (Fortigate NGFW) Versions with FortiOS < 7.4.10

Timeline

2026-02-10: disclosed: Initial publication by Fortinet
2026-02-10: advisory: Fortinet advisory FG-IR-25-795 published
2026-03-10: advisory: Siemens advisory SSA-975644 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.