CVE-2025-62631 MEDIUM

CVE-2025-62631

Vendor Fortinet
Product FortiOS
Weakness CWE-613 · Insufficient session expiration
Published December 9, 2025
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

What the vulnerability does

01Description

An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control

Key dates

02Disclosure timeline

December 9, 2025 CVE published
May 12, 2026 Record updated