---
id: CVE-2025-62631
title: >-
  An insufficient session expiration vulnerability [CWE-613] vulnerability in
  Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions,
  FortiOS 6.4 all versions allows attacker to maintain access to network
  resources via …
summary: >-
  An insufficient session expiration vulnerability [CWE-613] vulnerability in
  Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions,
  FortiOS 6.4 all versions allows attacker to maintain access to network
  resources via …
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-613
vendor: fortinet
product: fortios
affected:
  - 'fortios >= 6.4.0, < 7.4.1'
patched:
  - fortios 7.4.1
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62631'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-25-411'
    label: psirt@fortinet.com
tags:
  - nvd
epss: 0.00301
epssPercentile: 0.2121
ingestedAt: '2026-10-14T21:57:04.762Z'
---

## Overview

An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control

## Affected

- `fortios >= 6.4.0, < 7.4.1`

## Remediation

Upgrade past the affected range:

- `fortios 7.4.1`