CVE-2025-62631

An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control

CVSS 3.1

5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-25)

CWE

CWE-613

Published

2025-12-09

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• fortinet:fortios

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-411

Check your stackJSON