LiveThreat Vulnerability Brief — CVE-2025-62676
What It Is — Fortinet FortiClient VPN contains a local‑privilege‑escalation flaw in its FCConfig utility that lets a low‑privileged attacker create a malicious junction and overwrite arbitrary files, ultimately executing code as SYSTEM. Exploitability — Proof‑of‑concept code is publicly available; the vulnerability scores 7.8 (CVSS 3.1) and is actively exploitable on unpatched installations.
Affected Products — Fortinet FortiClient VPN (all versions prior to the February 2026 security update). TPRM Impact — Organizations that depend on FortiClient for remote access—especially managed‑service providers, supply‑chain partners, and any third‑party that provisions VPN clients to employees—face a supply‑chain risk where a compromised endpoint can be leveraged to infiltrate partner networks and downstream services.
Recommended Actions — Deploy Fortinet’s patch (FG‑IR‑25‑661) immediately; enforce least‑privilege for local accounts; enable monitoring for unexpected file‑write activity in the FortiClient configuration directory; consider temporary use of an alternative VPN client until remediation is confirmed. Source: Zero Day Initiative Advisory