Arbitrary process termination from exposed minifilter communication port

Fortinet FortiClient Windows fortimon3 driver flaw (CVSS 4.7) lets authenticated attackers terminate arbitrary processes via exposed minifilter communication port.

Fortinet advisory FG-IR-26-165 discloses an unverified ownership vulnerability (CWE-283, CVSSv3 4.7) in the FortiClient Windows fortimon3 minifilter driver. An authenticated attacker can terminate arbitrary processes through an exposed minifilter communication port. The advisory was revised on 2026-09-08.

• Unverified ownership (CWE-283) in FortiClient fortimon3 driver, CVSSv3 4.7
• Exposed minifilter communication port allows arbitrary process termination
• Requires an authenticated attacker, impact limited to denial of service