FortiClient CORS flaw allows website-triggered RCE (CVE-2026-121529)
Fortinet says the CVSS 9.1 bug is not known exploited; fixes are 7.4.8 and 7.2.15, with no virtual patch.
74
CVE-2026-121529
Origin validation error in Fortinet FortiClient (user interaction)
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An origin validation error in Fortinet FortiClient for macOS, Windows, and Windows PAM may let an unauthorized remote attacker run unauthorized code or commands. The attacker needs no account, but the victim must interact with the attack. Affected builds are FortiClientMac 7.4.0–7.4.7, FortiClientWindows 7.4.0–7.4.7 and 7.2.0–7.2.14, and FortiClientWindowsPAM 7.4.7 and 7.2.14. Fortinet has not listed fixed versions.
What to do: Apply Fortinet's update for CVE-2026-121529. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Fortinet FortiClientMac | 7.4.0 through 7.4.7 |
| Fortinet FortiClientWindows | 7.4.0 through 7.4.7 |
| Fortinet FortiClientWindows | 7.2.0 through 7.2.14 |
| Fortinet FortiClientWindowsPAM | 7.4.7 |
| Fortinet FortiClientWindowsPAM | 7.2.14 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.
- Weakness
- CWE-346
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
In the news
2 storiesFortinet patches FortiClient flaw that runs code from malicious sites
CVE-2026-121529 affects FortiClient 7.2 and 7.4 branches; Fortinet says exploitation is not known.
71