CVE-2025-62439 describes an improper access control vulnerability in Fortinet FortiOS that affects multiple major versions including 7.6.x, 7.4.x, 7.2.x, and 7.0.x. The flaw involves improper verification of the source of a communication channel related to FSSO policy configurations. An authenticated user with knowledge of these configurations could exploit this by crafting specific requests to gain unauthorized access to network resources that should be protected. The CVSS 3.1 vector indicates the attack requires local access with low privileges, high complexity, no user interaction, and impacts confidentiality and integrity to a limited degree. No official patch or remediation details are provided in the available data, and no known exploits have been reported.

The impact is limited to unauthorized access to protected network resources by an authenticated user who already has some knowledge of FSSO policies. The confidentiality and integrity of some data may be compromised, but availability is not affected. The low CVSS score reflects the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the Fortinet vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, organizations should monitor Fortinet advisories closely. Restricting access to FSSO policy configurations and limiting authenticated user privileges may reduce risk until a fix is available.