This vulnerability in Fortinet FortiOS affects multiple versions (6.4.0, 7.0.0, 7.2.0, 7.4.0) and is caused by insufficient session expiration (CWE-613). Specifically, SSLVPN sessions are not terminated after a user's password change under particular conditions, allowing an attacker to retain access to network resources. The CVSS v3.1 base score is 5.3 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability to a limited extent. An official fix has been released by Fortinet.

An attacker can maintain unauthorized access to network resources via an active SSLVPN session even after the legitimate user changes their password, potentially allowing continued access without re-authentication. The impact affects confidentiality, integrity, and availability but is limited by the conditions required for exploitation and the high attack complexity.

An official fix is available from Fortinet for this vulnerability. It is recommended to apply the vendor-provided patches promptly to ensure SSLVPN sessions are properly terminated after password changes. Since this is not a cloud service, remediation depends on applying the patch to affected FortiOS devices. No additional mitigation steps are indicated by the vendor advisory.