Fortinet FortiOS CVE-2025-62631

Exploitation requires that the attacker ALREADY possesses an active FortiOS SSLVPN session, AND that the password of the associated user account is subsequently changed or reset while that session is still live. The defect is that FortiOS does not terminate the pre-existing SSLVPN session on the password change, so access persists. Limiting factors: the triggering event (the password change) is a victim or administrator action the attacker cannot force (reflected as AC:H); it applies specifically to deployments with the SSLVPN feature in use (units without SSLVPN are not exposed); and it occurs only 'under particular conditions outside of the attacker's control,' so it is not reliably reproducible on demand. Affected builds are FortiOS 7.4.0 and all releases of 7.2, 7.0, and 6.4.

This is a moderate, context-dependent issue rather than a top-tier priority. CVSS 3.1 base score is 5.6 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L: although attack vector is Network and no privileges are formally required at exploitation time, Attack Complexity is High precisely because the vulnerable condition (a password change that fails to terminate an existing SSLVPN session) occurs 'under particular conditions outside of the attacker's control' - the attacker cannot reliably trigger it on demand. EPSS reinforces low urgency at 0.30% (21st percentile), there is no CISA KEV listing, and no public exploit identified, so there is no evidence of active exploitation. A tension worth flagging: PR:N technically marks this unauthenticated, but the scenario inherently assumes the attacker ALREADY holds a live SSLVPN session (i.e., possessed valid credentials at some earlier point) - the real-world precondition is prior access, not an anonymous remote attack, so treat the PR:N labeling with caution. The SSVC-style read is: exploitation status = none observed, automatable = no (it depends on a victim-side password-change event the attacker cannot force), technical impact = partial (C:L/I:L/A:L). Net: a real credential-rotation/offboarding hygiene gap, not a drop-everything emergency.

An attacker who already holds an active FortiOS SSLVPN session - for example a departed employee, or someone using credentials that are later reset after suspected compromise - retains that tunnel after the account's password is changed, because the session is not invalidated. They thereby keep reaching internal network resources even though the credential that granted access has been revoked. No public exploit code is required or identified; the flaw is passive session persistence triggered by a victim-side password change (AC:H, outside the attacker's control).