CVE-2025-62676: Fortinet FortiClient Privilege Escalation

CVE-2025-62676 Overview

CVE-2025-62676 is an Improper Link Resolution Before File Access [CWE-59] vulnerability in Fortinet FortiClient for Windows. The flaw allows a local low-privilege attacker to perform arbitrary file writes with elevated permissions through crafted named pipe messages. The vulnerability affects FortiClientWindows versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.12, and all 7.0 versions.

Critical Impact

A local attacker with low privileges can write arbitrary files using elevated permissions, enabling privilege escalation to SYSTEM and full host compromise on affected Windows endpoints.

Affected Products

• Fortinet FortiClientWindows 7.4.0 through 7.4.4
• Fortinet FortiClientWindows 7.2.0 through 7.2.12
• Fortinet FortiClientWindows 7.0 (all versions)

Discovery Timeline

• 2026-02-10 - CVE-2025-62676 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-62676

Vulnerability Analysis

The vulnerability resides in how FortiClient for Windows handles file operations triggered through its privileged named pipe interface. The service component, which runs with SYSTEM privileges, accepts messages from local clients over a named pipe. When processing these messages, the service performs file operations without adequately validating whether the target paths are symbolic links, junctions, or hard links.

A local low-privilege attacker can plant filesystem links pointing to protected locations and then send crafted named pipe messages that cause the privileged service to follow these links. The service then writes attacker-controlled content to files it would normally be unable to modify based on the attacker's own token.

Exploitation requires only local access with low privileges. No user interaction is needed. The result is high impact to integrity and availability, while confidentiality is not directly affected.

Root Cause

The root cause is the absence of link resolution checks before file access in the privileged FortiClient service. The service trusts paths supplied through the named pipe channel and performs write operations without opening files with flags such as FILE_FLAG_OPEN_REPARSE_POINT or verifying the final canonical path against an allowlist.

Attack Vector

The attack vector is local. An authenticated user on the Windows host creates a symbolic link, NTFS junction, or hard link at a path the FortiClient service writes to, then sends a crafted message to the named pipe to trigger the write. The privileged service follows the link and writes attacker-controlled data to a SYSTEM-protected file such as a DLL loaded by a privileged process. This enables arbitrary code execution as SYSTEM.

No public proof-of-concept code is available for CVE-2025-62676. Technical details are described in the FortiGuard Security Advisory FG-IR-25-661.

Detection Methods for CVE-2025-62676

Indicators of Compromise

• Creation of symbolic links, NTFS junctions, or hard links by non-administrative user processes targeting paths under C:\Program Files\Fortinet\ or C:\ProgramData\Fortinet\.
• Unexpected file writes performed by the FortiClient service process to locations outside its normal working directories.
• New or modified DLLs, executables, or configuration files in SYSTEM-writable paths immediately following named pipe activity to FortiClient endpoints.

Detection Strategies

• Monitor process creation and file system events for mklink, CreateSymbolicLink, and DeviceIoControl calls issuing FSCTL_SET_REPARSE_POINT from non-privileged contexts.
• Correlate named pipe client connections to FortiClient pipes with subsequent file writes by the FortiClient service to sensitive directories.
• Alert on FortiClient service processes opening files that traverse reparse points originating in user-writable directories.

Monitoring Recommendations

• Enable Windows Sysmon Event IDs 11 (FileCreate), 15 (FileCreateStreamHash), and 17/18 (Pipe events) and ship logs to a centralized analytics platform for correlation.
• Audit FortiClient version inventory across managed Windows endpoints to identify hosts running affected releases.
• Track privilege escalation patterns where a low-privilege user is followed by SYSTEM-context file modifications within a short time window.

How to Mitigate CVE-2025-62676

Immediate Actions Required

• Upgrade FortiClientWindows 7.4.x to version 7.4.5 or later as specified in the FortiGuard advisory.
• Upgrade FortiClientWindows 7.2.x to version 7.2.13 or later per vendor guidance.
• Migrate FortiClientWindows 7.0.x installations to a supported, fixed branch, as all 7.0 versions are affected.
• Inventory all Windows endpoints running FortiClient and prioritize patching on multi-user systems and jump hosts.

Patch Information

Fortinet has published patches and remediation guidance in the FortiGuard Security Advisory FG-IR-25-661. Administrators should consult the advisory for the exact fixed versions corresponding to each affected branch and follow the documented upgrade path.

Workarounds

• Restrict interactive and remote local logon on systems running affected FortiClient versions until patches are deployed.
• Apply application control policies to prevent untrusted binaries from executing in user-writable directories that could be leveraged after a privileged file write.
• Enforce least-privilege account configurations and disable unnecessary local user accounts to reduce the population of potential local attackers.

# Verify installed FortiClient version on Windows endpoints
wmic product where "name like 'FortiClient%%'" get name,version

# PowerShell alternative
Get-CimInstance -ClassName Win32_Product | Where-Object { $_.Name -like 'FortiClient*' } | Select-Object Name,Version