FortiClient CORS flaw allows website-triggered RCE (CVE-2026-121529)
Original title: Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled
Fortinet says the CVSS 9.1 bug is not known exploited; fixes are 7.4.8 and 7.2.15, with no virtual patch.
Fortinet warned on November 10, 2026, that FortiClient has an origin-validation error, CVE-2026-121529, scored 9.1. A malicious page can send requests to a local service and run attacker-supplied code without a login; the user must open the page. Kevin Joensen of Baldur Security found it and nicknamed it Fortinet2Shell. Fortinet says it is not known to be exploited, but technical details are public.
Unconfirmed: Fortinet says exploitation is not known; public details make copying the attack easier, but no attacks are confirmed.
- Affected ranges include FortiClient Mac and Windows 7.4.0 through 7.4.7.
- Windows and Windows PAM 7.2.0 through 7.2.14 are also affected.
- The 8.0 branch and FortiClient Mac 7.2 are unaffected.
- Windows exposure clues are TCP port 9191 and FortiVRS.exe, not proof of attack.
- The issue is CWE-346 and rated unauthenticated under the API component.
Impact: Unauthenticated code execution after a user opens a page
| Product | Affected | Fixed in |
|---|---|---|
| Fortinet FortiClient Mac | 7.4.0 through 7.4.7 | 7.4.8 or later |
| Fortinet FortiClient Windows | 7.4.0 through 7.4.7 | 7.4.8 or later |
| Fortinet FortiClient Windows | 7.2.0 through 7.2.14 | 7.2.15 or later |
| Fortinet FortiClient Windows PAM | 7.4.0 through 7.4.7 | 7.4.8 or later |
| Fortinet FortiClient Windows PAM | 7.2.0 through 7.2.14 | 7.2.15 or later |
- 1.Upgrade 7.4 installs to 7.4.8 or later and 7.2 installs to 7.2.15 or later.
- 2.Prioritize hosts listening on TCP port 9191 or running FortiVRS.exe.
- 3.Warn users about unknown links and review web filtering during rollout.
- CVEs
- CVE-2026-121529
- Vendors
- Fortinet
- Products
- FortiClientFortiPAM
- Organizations
- Baldur Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121529 | Origin validation error in Fortinet FortiClient (user interaction) | 9.6 | — | PoC |
From the original article
2 min read at cybersecuritynews.com
Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.