PT-2025-50125 · Fortinet · Fortios

Published 2025-12-09 · Updated 2025-12-10 · CVE-2025-62631

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 6.4, 7.0, 7.2, and 7.4.0

Description An insufficient session expiration exists in Fortinet FortiOS. Specifically, an active SSLVPN session may not terminate after a user’s password change under certain conditions. This could allow an attacker to maintain access to network resources.

Recommendations Fortinet FortiOS version 7.4.1 or later should be used. Fortinet FortiOS version 7.2.5 or later should be used. Fortinet FortiOS version 7.0.10 or later should be used. Fortinet FortiOS version 6.4.11 or later should be used.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2026-00834

CVE-2025-62631

Affected Products

Fortios

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-62631 · Security Note
• https://bdu.fstec.ru/vul/2026-00834 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62631 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-25-411 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998781400707637584 · Twitter Post