Is CVE-2024-50562 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-50562 being exploited in the wild.

How severe is CVE-2024-50562?

Medium severity, with a CVSS score of 4.8, published 10 June 2025.

Which products and versions are affected?

Fortinet FortiGate NGFW versions with Fortigate NGFW < V7.4.9; Fortinet FortiOS 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0 all versions, 6.4 all versions; Fortinet Fortisase 24.4.b; Siemens Ruggedcom Ape1808 versions with Fortigate NGFW < V7.4.9.

Is there a fix for CVE-2024-50562?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-50562 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2024-50562?

Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-50562: Fortinet FortiOS insufficient session expiration in SSL-VPN

Q: Is there a fix for CVE-2024-50562?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2024-50562 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2024-50562?

Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-50562 · Severity: medium · CVSS 4.8 · Published 2025-06-10

A security flaw has been identified in Fortinet's networking software that manages secure remote access (SSL-VPN). This vulnerability could allow an unauthorized person who has obtained a previous login cookie to reuse it to gain access to the network, even if the original session had already expired or the user had logged out. This could lead to unauthorized access to internal corporate resources and sensitive data.

Technologies: Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortisase, Siemens Ruggedcom Ape1808. Vendors: Fortinet, Siemens.

Quick answers

Is CVE-2024-50562 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-50562 being exploited in the wild.
How severe is CVE-2024-50562?: Medium severity, with a CVSS score of 4.8, published 10 June 2025.
Which products and versions are affected?: Fortinet FortiGate NGFW versions with Fortigate NGFW < V7.4.9; Fortinet FortiOS 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0 all versions, 6.4 all versions; Fortinet Fortisase 24.4.b; Siemens Ruggedcom Ape1808 versions with Fortigate NGFW < V7.4.9.
Is there a fix for CVE-2024-50562?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-50562 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2024-50562?: Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insufficient Session Expiration vulnerability (CWE-613) exists in the SSL-VPN component of FortiOS. The flaw allows a session cookie to remain valid or be accepted for re-authentication even after a user has explicitly logged out or the session timeout period has elapsed. An attacker who successfully intercepts or otherwise obtains a valid SSL-VPN session cookie can reuse it to gain unauthorized access to the VPN portal. The attack requires the attacker to already possess a valid cookie (High Attack Complexity) but does not require active user interaction or existing credentials. The issue is resolved in FortiOS versions 7.6.1, 7.4.8, and 7.2.11. Tunnel mode is reportedly not affected.

Affected products

Fortinet FortiOS 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0 all versions, 6.4 all versions
Fortinet FortiSASE 24.4.b
Siemens RUGGEDCOM APE1808 (Fortigate NGFW) versions with Fortigate NGFW < V7.4.9

Timeline

2025-05-13: advisory: Siemens published initial advisory SSA-864900
2025-06-10: disclosed: Fortinet published FG-IR-24-339
2025-06-10: advisory: NVD published CVE-2024-50562 detail

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.