Back fortiguard.fortinet.com

FG IR 26 194

fortiguard.fortinet.com • November 11, 2026

An origin validation error vulnerability [CWE-346] in FortiClient Mac, FortiClient Windows, and FortiClient Windows PAM may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.

Fortinet is pleased to thank Kevin Joensen from Baldur Security for reporting this vulnerability under responsible disclosure.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Fortinet2Shell Vulnerability Allows Remote Code Execution via Malicious Websites A critical vulnerability in FortiClient, tracked as CVE-2026-121529, has been disclosed, allowing attackers to execute arbitrary code on systems through malicious websites. This flaw is due to an origin validation error in the local API, affecting FortiClient Windows, Windows PAM, and Mac versions 7.2 and 7.4. The vulnerability has a CVSS score of 9.1, indicating high severity. Successful exploitation requires user interaction, as the victim must visit a malicious page. Fortinet released a patch on November 10, 2026, urging users to update to version 7.4.8 or 7.2.15 to mitigate the risk. The vulnerability is not currently known to be, but it poses a significant risk due to its nature and the ease of exploitation. Security teams are advised to check for specific signs of vulnerability on affected systems. 2 sources 71

Extracted Entities

FG IR 26 194

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)