CVE-2025-55018
CVSS 5.8 MEDIUM: an inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0… EPSS 0.4% (32nd percentile).
Vulnerabilities & Exploits
Siemens ProductCERT flagged two Fortinet FortiOS vulnerabilities: CVE-2025-55018 and CVE-2025-62439. They may allow an unauthenticated actor to smuggle unlogged HTTP requests through firewall policies and allow authenticated users to gain unauthorized access to protected network resources.
1 source · Mar 10
CVSS 5.8 MEDIUM: an inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0… EPSS 0.4% (32nd percentile).
CVSS 4.2 MEDIUM: an Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet… EPSS 0.2% (4th percentile).
Siemens ProductCERT
SSA-027652
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms.
originalSiemens ProductCERT
SSA-770770
Siemens has identified the following specific mitigations that customers can apply to reduce the risk: Product-specific remediations or mitigations can be found in the section Known Affected Products.
originalSiemens ProductCERT
SSA-975644
originalPart of the PlainSec briefing for 2026-03-10
Every edition of this story: FortiOS flaws could bypass firewall logging, access protected networks