onyx

onyx --cves cve-2025-62631

CVE-2025-62631

MEDKEVFortinet FortiOS
score
3.8
cvss
5.6
epss
0.3%
published
2025-12-09
kev added
2026-07-23
first seen

Fortinet FortiOS 7.4.0, 7.2, 7.0, and 6.4 contain an insufficient session expiration vulnerability caused by active SSLVPN sessions not terminating after user password changes, letting attackers maintain network access, exploit requires active SSLVPN session.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2025-12-09 — PublishedP2026-07-23 — Added to CISA KEVK2026-10-21 — Tracked by OnyxTscore2026-10-21: score 3.83.8epss2026-09-22: epss 0.3%2026-09-23: epss 0.3%2026-09-24: epss 0.3%2026-09-25: epss 0.3%2026-09-26: epss 0.3%2026-09-27: epss 0.3%2026-09-29: epss 0.3%2026-09-30: epss 0.3%2026-10-01: epss 0.3%2026-10-02: epss 0.3%2026-10-03: epss 0.3%2026-10-04: epss 0.3%2026-10-05: epss 0.3%2026-10-06: epss 0.3%2026-10-07: epss 0.3%2026-10-08: epss 0.3%2026-10-09: epss 0.3%2026-10-10: epss 0.3%2026-10-11: epss 0.3%2026-10-12: epss 0.3%2026-10-13: epss 0.3%2026-10-14: epss 0.3%2026-10-15: epss 0.3%2026-10-16: epss 0.3%2026-10-18: epss 0.3%2026-10-19: epss 0.3%2026-10-20: epss 0.3%2026-10-21: epss 0.3%0.3%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Added to CISA KEV
  3. Tracked by Onyx

Weaknesses

CWE-613

References 2