CVE-2025-25252 - CVE House

Back to Database

Status published Medium CVE-2025-25252

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN...

4.3 CVSS

Vulnerability Description

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-25252

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-487

More from Fortinet

View All →

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability...

An improper limitation of a pathname to a restricted directory...

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer...

A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through...

An Internal Asset Exposed to Unsafe Debug Access Level or...

Affected Vendor

Fortinet

View all reports →

Affected Software

FortiOS

Vulnerable Versions:

7.6.0, 7.4.0, 7.2.0, 7.0.0, 6.4.0

Timeline

Official Publish: October 14th, 2025

Last Modified: January 14th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1539 Steal Web Session Cookie

Credential Access

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1021 Remote Services

Lateral Movement

T1562 Impair Defenses

Defense Evasion