{"id":"CVE-2025-62631","published":"2025-12-09T17:18:47Z","modified":"2026-05-12T09:57:29Z","title":"An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all…","vendor":"Fortinet","product":"FortiOS","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiOS","versions":["7.4.0",">= 7.2.0, <= 7.2.13",">= 7.0.0, <= 7.0.19",">= 6.4.0, <= 6.4.16"]}],"description":{"text":"An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00301,"percentile":0.22771,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-07-23","exploitedFirstSeen":"2026-07-23","ransomware":false,"evidence":[{"url":"https://www.levelblue.com/blogs/spiderlabs-blog/ttp-briefing-q2-2026","date":"2026-07-23"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-613","name":"DEPRECATED: Insufficient Session Expiration"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-411","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-202274","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202274","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-12-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-62631","provenance":"source"},{"date":"2026-07-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.levelblue.com/blogs/spiderlabs-blog/ttp-briefing-q2-2026","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":48.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 99 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.55,"detail":"percentile 0.2277"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}