CVE-2025-62631
published 2025-12-09CVE-2025-62631: An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS…
PriorityP180medium5.6CVSS 3.1
AVNACHPRNUINSUCLILAL
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.30%
20.7th percentile
An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | >= 6.4.0 < 7.4.1 | 7.4.1 |
| fortinet | fortios | 6.4.0 – 6.4.16 | — |
| fortinet | fortios | 7.0.0 – 7.0.19 | — |
| fortinet | fortios | 7.2.0 – 7.2.13 | — |
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vulncheck5.6MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-chj4-wrc6-847j: An insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7
ghsa_unreviewed·2025-12-09
CVE-2025-62631 [MEDIUM] CWE-613 GHSA-chj4-wrc6-847j: An insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7
An insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control
VulnCheck
Fortinet FortiOS Insufficient Session Expiration
vulncheck·2025·CVSS 5.6
CVE-2025-62631 [MEDIUM] Fortinet FortiOS Insufficient Session Expiration
Fortinet FortiOS Insufficient Session Expiration
An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control
Affected: Fortinet FortiOS
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.levelblue.com/blogs/spiderlabs-blog/ttp-briefing-q2-2026
Fortinet
Insufficient Session Expiration in SSLVPN
vendor_fortinet·2025-12-09·CVSS 5.6
CVE-2025-62631 [MEDIUM] CWE-613 Insufficient Session Expiration in SSLVPN
FG-IR-25-411: Insufficient Session Expiration in SSLVPN
An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control
CVEs: CVE-2025-62631
CWEs: CWE-613
CVSS: 5.6 (medium)
Affected products: FortiOS, Fortinet
No detection rules found.
No public exploits indexed.
2025-12-09
Published
Exploited in the wild