Cyber Posture

CVE-2025-62676

High

Published: 10 February 2026

Published
10 February 2026
Modified
12 February 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0001 0.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-62676 is a high-severity Link Following (CWE-59) vulnerability in Fortinet Forticlient. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068).
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Local low-priv arbitrary file write with elevation directly enables Exploitation for Privilege Escalation (T1068) via overwriting system binaries or configs.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4, FortiClientWindows 7.2.0 through 7.2.12, FortiClientWindows 7.0 all versions may allow a local low-privilege attacker to perform an arbitrary file write with elevated…

more

permissions via crafted named pipe messages.

Deeper analysisAI

CVE-2025-62676 is an Improper Link Resolution Before File Access vulnerability, classified under CWE-59, affecting Fortinet FortiClient for Windows in versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.12, and all versions of 7.0. The issue stems from improper handling that may allow exploitation through crafted named pipe messages, resulting in a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability to perform an arbitrary file write operation with elevated permissions. This requires local access to the system but no user interaction, enabling the attacker to overwrite critical files and potentially escalate privileges or disrupt system integrity and availability.

Mitigation details are available in the Fortinet product security incident response team advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-661, published on 2026-02-10. Security practitioners should consult this reference for patching instructions and workarounds specific to the affected FortiClient versions.

Details

CWE(s)

Affected Products

fortinet
forticlient
7.0.0 — 7.2.13 · 7.4.0 — 7.4.5

CVEs Like This One

CVE-2026-24018Same product: Fortinet Forticlient
CVE-2024-52968Same product: Fortinet Forticlient
CVE-2023-45588Same product: Fortinet Forticlient
CVE-2025-64157Same product class: VPN / SSL gateway
CVE-2020-9295Same product: Fortinet Forticlient
CVE-2026-22153Same product class: VPN / SSL gateway
CVE-2024-26006Same product class: VPN / SSL gateway
CVE-2025-59718Same product class: VPN / SSL gateway
CVE-2024-26009Same product class: VPN / SSL gateway
CVE-2024-45324Same product class: VPN / SSL gateway

References