An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10…

cve CVE-2025-25252 1 source, 1 claim · Watch

NVD writes:
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record. the claim

Severity: MEDIUM NVD
CVSS: 6.5 NVD
Vendor: Fortinet NVD
Product: FortiOS NVD
CWE: CWE-613 NVD

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Timeline

2025-10-14

first spoke of it: An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

NVD

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

What it is to other things

affects	fortinet/fortios NVD
made_by	fortinet NVD

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

At least one of those steps needs a person.

receipt

Source: NVD
Its words: no
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	no
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

NVD

6.5

receipt

Source: NVD
Its words: 6.5
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-10-06 11:32 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:32 UTC	6.5
2026-09-29 09:45 UTC	4.8

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

receipt

Source: NVD
Its words: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CWE

cwe

NVD

CWE-613

receipt

Source: NVD
Its words: CWE-613
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	CWE-613
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Exploitation

exploitation

NVD

none

No evidence of exploitation, and no public proof of concept.

receipt

Source: NVD
Its words: none
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	none
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Product

product

NVD

FortiOS

receipt

Source: NVD
Its words: FortiOS
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	FortiOS
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Severity

severity

NVD

MEDIUM

From 4.0 to 6.9.

receipt

Source: NVD
Its words: MEDIUM
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	MEDIUM
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

medium

Status

status

NVD

Analyzed

receipt

Source: NVD
Its words: Analyzed
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

partial

The attacker gains limited control, or limited information.

receipt

Source: NVD
Its words: partial
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	partial
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

Fortinet

receipt

Source: NVD
Its words: Fortinet
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Fortinet
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-09-13T04:17:02.730",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

zetlyn/cve-nvd · 2025-10-14

automatable no cvss 6.5 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N cwe CWE-613 exploitation none product FortiOS severity MEDIUM status Analyzed technical_impact partial vendor Fortinet

source