Fortinet patches FortiClient flaw that runs code from malicious sites
Original title: Fortinet2Shell Vulnerability Lets Hackers Execute Code on FortiClient Systems Through Malicious Websites
CVE-2026-121529 affects FortiClient 7.2 and 7.4 branches; Fortinet says exploitation is not known.
Fortinet fixed an origin-validation error in a local FortiClient API that trusts browser requests from any website. A victim who opens an attacker page can have arbitrary code run without authentication, though user interaction is required. Builds in the 7.4 and Windows 7.2 lines need updates; 8.0 is unaffected. Fortinet says there is no virtual patch and no known exploitation.
Unconfirmed: Researcher Kevin Joensen says exploitation works reliably when FortiPAM is enabled.
- Fortinet published advisory FG-IR-26-194 on November 10, 2026.
- Fortinet rates the flaw Critical, with a CVSS v3 score of 9.1.
- Mac and Windows 7.4 builds 7.4.0 through 7.4.7 are affected.
- Windows and Windows PAM 7.2 builds 7.2.0 through 7.2.14 are affected.
- Version 8.0 and FortiClient Mac 7.2 are not affected.
Impact: arbitrary code execution on the endpoint via a malicious site
| Product | Affected | Fixed in |
|---|---|---|
| Fortinet FortiClient Mac | 7.4.0 through 7.4.7 | 7.4.8 or above |
| Fortinet FortiClient Windows | 7.4.0 through 7.4.7; 7.2.0 through 7.2.14 | 7.4.8 or above; 7.2.15 or above |
| Fortinet FortiClient Windows PAM | 7.4.0 through 7.4.7; 7.2.0 through 7.2.14 | 7.4.8; 7.2.15 |
- 1.Upgrade FortiClient Mac and Windows 7.4 to 7.4.8 or above.
- 2.Upgrade FortiClient Windows and Windows PAM 7.2 to 7.2.15 or above.
- 3.Hunt for TCP port 9191 listeners and a running FortiVRS.exe process.
- CVEs
- CVE-2026-121529
- Vendors
- Fortinet
- Organizations
- Baldur Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121529 | Origin validation error in Fortinet FortiClient (user interaction) | 9.6 | — | PoC |
From the original article
2 min read at gbhackers.com
Fortinet has patched a critical flaw in FortiClient that lets attackers run code on a victim’s computer through a malicious website. The bug is tracked as CVE-2026-121529 (advisory FG-IR-26-194). Researcher Kevin Joensen of Baldur Security reported it and nicknamed it “Fortinet2Shell.”
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.