CyberCVE

CVE-2025-25252

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote

Severity
Medium 4.3
CVSS 3.1
Exploited
Not listed
EPSS
0.003
27.2th percentile
Discovered by
Third party
Vendor advisory field
Published
Oct 14, 2025
Assigned by fortinet

Description

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

Weakness: CWE-613

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiOS

Credit

Fortinet is pleased to thank William Le Berre from BZHunt for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiOS version 7.6.3 or above Upgrade to FortiOS version 7.4.7 or above

References

Something wrong here?