CVE-2025-62676
Published: 10 February 2026
Summary
CVE-2025-62676 is a high-severity Link Following (CWE-59) vulnerability in Fortinet Forticlient. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local low-priv arbitrary file write with elevation directly enables Exploitation for Privilege Escalation (T1068) via overwriting system binaries or configs.
NVD Description
An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4, FortiClientWindows 7.2.0 through 7.2.12, FortiClientWindows 7.0 all versions may allow a local low-privilege attacker to perform an arbitrary file write with elevated…
more
permissions via crafted named pipe messages.
Deeper analysisAI
CVE-2025-62676 is an Improper Link Resolution Before File Access vulnerability, classified under CWE-59, affecting Fortinet FortiClient for Windows in versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.12, and all versions of 7.0. The issue stems from improper handling that may allow exploitation through crafted named pipe messages, resulting in a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability to perform an arbitrary file write operation with elevated permissions. This requires local access to the system but no user interaction, enabling the attacker to overwrite critical files and potentially escalate privileges or disrupt system integrity and availability.
Mitigation details are available in the Fortinet product security incident response team advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-661, published on 2026-02-10. Security practitioners should consult this reference for patching instructions and workarounds specific to the affected FortiClient versions.
Details
- CWE(s)