Insufficient Session Expiration Vulnerability in Fortinet FortiOS

CVE-2025-62631

What is CVE-2025-62631?

An insufficient session expiration issue in Fortinet's FortiOS may allow an attacker to maintain unauthorized access to network resources. This vulnerability arises when an active SSLVPN session persists despite a user changing their password, under certain conditions not influenced by the attacker. Users need to be mindful of potential security risks, as this flaw could allow continued access even after credentials have been updated.

References