Fortinet patches raft of vulnerabilities, but is 'security through obscurity' enough?

Fortinet has patched a critical FortiClient vulnerability, dubbed Fortinet2Shell, that could allow attackers to execute malicious code on Windows and macOS devices by luring victims to a malicious website.

CVE-2026-121529 has a CVSS score of 9.1 and stems from improper security restrictions in a local API service, potentially enabling unauthenticated endpoint compromise on systems with FortiPAM enabled.

The vulnerability affects FortiClient versions 7.4.0–7.4.7 on Windows and macOS, and 7.2.0–7.2.14 on Windows.

Fortinet has released fixes in versions 7.4.8 and 7.2.15, with no confirmed exploitation in the wild – so far.

That vulnerability is one of dozens the company addressed on November 10, all rated either critical or high severity.

According to Jake Knott, cyber security firm WatchTowr’s head of threat intelligence, the rate of patch releases and Fortinet’s management is less than ideal.

"Fortinet appliances are absolutely everywhere across enterprise networks, and in many cases are designed to be public-facing or route public traffic. Any time a vulnerability drops, the entire industry, including researchers and attackers, pays attention because of that prevalence alone,” Knott told Cyber Daily.

“On November 10th, as part of Patch Tuesday, Fortinet published a huge number of advisories across a broad spectrum of products, with many impacting FortiManager appliances.

“These provided the technical details for October 22nd’s ‘Security Hardening Release’, which fixed many of these vulnerabilities but withheld details until Patch Tuesday, in an effort to combat AI-assisted reverse engineering and exploitation.”

Knott said that while no doubt well-intentioned, this form of “security through obscurity” is not fit for purpose.

“Hiding details and technical information mitigates only one class of attacker, the low-skilled kind, while the same patches, the same diffs, and fundamentally the same information remain in the hands of well-resourced attackers. They can cause the same surgical damage and take advantage of security teams that don’t treat obscure “critical and high-severity fixes” the same as a named vulnerability class with clear impact,” he said.

“Instead of waiting for an advisory (like November 10’s) to be made public, AI-enabled attackers can point LLMs and harnesses at patches and software updates, and put their tokens to use there with the same outcome.”

It’s a situation we’ve seen before, Knott believes, noting that ‘FortiJump’ was exploited as a zero-day for nearly four months before it was disclosed.

“We don’t expect this time to be any different. This service is an extremely attractive and proven attack surface, and we expect attackers to be jumping at the chance to exploit it,” Knott said.

“Organisations with internet-facing FGFM services and FortiManager appliances should review and apply patches, or restrict access where possible."

David Hollingworth has been writing technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk Lego.