Siemens RUGGEDCOM APE1808 faces FortiOS XSS and path-traversal flaws

The two vulnerabilities land at medium severity but carry different operational profiles. CVE-2026-23573 (CVSS 6.1) is a cross-site scripting flaw in FortiOS 7.6.0 through 7.6.6 and all versions of 7.4 and 7.2 that lets an authenticated remote attacker execute code or commands through crafted requests, the kind of thing that matters when your firewall is the gatekeeper for OT network segmentation. CVE-2026-59839 (CVSS 5.5) is a path-traversal bug exploitable only by a privileged authenticated attacker with physical access to the device, making it a narrower but still destructive vector: filesystem deletion via crafted CLI commands.

For operators, the friction isn't the CVSS scores. It's the remediation gap. Siemens directs affected customers to contact support rather than publishing a patch timeline or version number, which is the recurring pattern for RUGGEDCOM APE1808 advisories. The platform has been a pass-through for upstream Fortinet and Palo Alto Networks vulnerabilities across multiple CISA advisories over the past two years. Organizations running APE1808 in critical manufacturing, energy, or transportation environments should apply Fortinet's recommended workarounds and contact Siemens support, but the absence of a fix date means risk assessments have to assume a longer exposure window than usual.