CVE-2025-62676
Published: 10 February 2026
Summary
CVE-2025-62676 is a high-severity Link Following (CWE-59) vulnerability in Fortinet Forticlient. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-62676 is an Improper Link Resolution Before File Access vulnerability, classified under CWE-59, affecting Fortinet FortiClient for Windows in versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.12, and all versions of 7.0. The issue stems from improper handling that may allow exploitation through crafted named pipe messages, resulting in a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability to perform an arbitrary file write operation with elevated permissions. This requires local access to the system but no user interaction, enabling the attacker to overwrite critical files and potentially escalate privileges or disrupt system integrity and availability.
Mitigation details are available in the Fortinet product security incident response team advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-661, published on 2026-02-10. Security practitioners should consult this reference for patching instructions and workarounds specific to the affected FortiClient versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206993
Vulnerability details
An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4, FortiClientWindows 7.2.0 through 7.2.12, FortiClientWindows 7.0 all versions may allow a local low-privilege attacker to perform an arbitrary file write with elevated…
more
permissions via crafted named pipe messages.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local low-priv arbitrary file write with elevation directly enables Exploitation for Privilege Escalation (T1068) via overwriting system binaries or configs.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces access control decisions on file write operations so that low-privilege named-pipe messages cannot result in elevated arbitrary file writes.
Requires validation of all input received via named pipes, directly blocking the crafted messages that trigger the link-following file-write flaw.
Limits the privileges assigned to the FortiClient service process, reducing the impact of any successful link-following exploitation by a low-privilege local user.