Skip to content
Critical Fortinet2Shell Vulnerability Allows Remote Code Execution via Malicious Websites

Critical Fortinet2Shell Vulnerability Allows Remote Code Execution via Malicious Websites

First seen 11 Nov 2026, 17:03 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 11, 2026 at 17:46 UTC
  • •CVE-2026-121529 allows unauthenticated remote code execution on FortiClient systems.
  • •Affected versions include FortiClient Windows and Mac versions 7.2 and 7.4.
  • •Fortinet released patches on November 10, 2026; users must upgrade to mitigate risks.

A critical vulnerability in FortiClient, tracked as CVE-2026-121529, has been disclosed, allowing attackers to execute arbitrary code on systems through malicious websites. This flaw is due to an origin validation error in the local API, affecting FortiClient Windows, Windows PAM, and Mac versions 7.2 and 7.4. The vulnerability has a CVSS score of 9.1, indicating high severity. Successful exploitation requires user interaction, as the victim must visit a malicious page. Fortinet released a patch on November 10, 2026, urging users to update to version 7.4.8 or 7.2.15 to mitigate the risk. The vulnerability is not currently known to be, but it poses a significant risk due to its nature and the ease of exploitation. Security teams are advised to check for specific signs of vulnerability on affected systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 19h ago How this analysis works

Timeline

2026-11-10
CVE-2026-121529 published
Fortinet disclosed a critical origin validation error in FortiClient, allowing remote code execution.
Gbhackers
2026-11-10
Patch released
Fortinet issued updates for FortiClient to address the critical vulnerability; users urged to upgrade.
Sploitus

More articles in this cluster (5)

Following this threat?

Track EKZ, Fortinet and CVE-2026-121529 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

Which versions of FortiClient are affected?
FortiClient Windows and Windows PAM versions 7.2.0 to 7.2.14 and 7.4.0 to 7.4.7, as well as FortiClient Mac versions 7.4.0 to 7.4.7.
What should organizations do to protect themselves?
Organizations should immediately upgrade to FortiClient versions 7.4.8 or 7.2.15 to mitigate the vulnerability.
Is there any evidence of exploitation in the wild?
Currently, there are no reports of exploitation in the wild, but the vulnerability poses a significant risk.