---
id: CVE-2024-50562
title: >-
  An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN
  version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all
  versions, 6.4 all versions may allow an attacker in possession of a cookie
  used to lo…
summary: >-
  An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN
  version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all
  versions, 6.4 all versions may allow an attacker in possession of a cookie
  used to lo…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-613
vendor: Fortinet
product: FortiOS
affected:
  - FortiOS 7.6.0
  - FortiOS 7.4.6
  - FortiOS >= 7.4.0 <= 7.4.4
  - FortiOS >= 7.2.0 <= 7.2.10
  - FortiOS >= 7.0.0 <= 7.0.17
  - FortiOS >= 6.4.0 <= 6.4.16
  - FortiPAM >= 1.4.0 <= 1.4.1
  - FortiPAM 1.3.0
  - FortiPAM 1.2.0
  - FortiPAM >= 1.1.0 <= 1.1.2
  - FortiPAM >= 1.0.0 <= 1.0.3
  - FortiProxy 7.6.0
  - FortiProxy >= 7.4.0 <= 7.4.5
  - FortiProxy >= 7.2.0 <= 7.2.14
  - FortiProxy >= 7.0.0 <= 7.0.20
  - FortiProxy >= 2.0.0 <= 2.0.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-06-10T19:30:09.729107Z'
exploitAvailable: true
published: '2025-06-10'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T00:58:06.067Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-50562'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-339'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-339'
tags:
  - cve.org
  - exploit-available
epss: 0.01159
epssPercentile: 0.66948
exploits:
  exploitdb: true
  github: 1
  githubRepos:
    - 'https://github.com/Shahid-BugB/fortinet-cve-2024-50562'
  checkedAt: '2026-10-27T16:43:15.690Z'
ingestedAt: '2026-10-15T04:46:37.340Z'
---

## Overview

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

## Affected

- `FortiOS 7.6.0`
- `FortiOS 7.4.6`
- `FortiOS >= 7.4.0 <= 7.4.4`
- `FortiOS >= 7.2.0 <= 7.2.10`
- `FortiOS >= 7.0.0 <= 7.0.17`
- `FortiOS >= 6.4.0 <= 6.4.16`
- `FortiPAM >= 1.4.0 <= 1.4.1`
- `FortiPAM 1.3.0`
- `FortiPAM 1.2.0`
- `FortiPAM >= 1.1.0 <= 1.1.2`
- `FortiPAM >= 1.0.0 <= 1.0.3`
- `FortiProxy 7.6.0`
- `FortiProxy >= 7.4.0 <= 7.4.5`
- `FortiProxy >= 7.2.0 <= 7.2.14`
- `FortiProxy >= 7.0.0 <= 7.0.20`
- `FortiProxy >= 2.0.0 <= 2.0.14`

## Remediation

Please upgrade to FortiOS version 7.6.1 or above 
Please upgrade to FortiOS version 7.4.8 or above 
Please upgrade to FortiOS version 7.2.11 or above 
Please upgrade to FortiSASE version 24.4.c or above