Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Fortinet patches FortiClient Fortinet2Shell; exploitation not known

3 sources · 3 articlesFirst reported Updated ()
What's new

November 11: GBHackers names the FortiClient advisory FG-IR-26-194, published November 10, and restates that exploitation is not known.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Fortinet has fixed critical FortiClient flaw CVE-2026-121529 and says it is not known to be exploited.

Fortinet has patched a critical origin-validation flaw in FortiClient, CVE-2026-121529, scored 9.1 and nicknamed Fortinet2Shell by Kevin Joensen of Baldur Security. A user who opens a malicious page can trigger unauthenticated code execution against a local service; Joensen says FortiPAM must be enabled and attributes the bug to a CORS misconfiguration. Affected builds are Mac and Windows 7.4.0–7.4.7 and Windows and Windows PAM 7.2.0–7.2.14; fixes are 7.4.8 and 7.2.15, with no virtual patch. Version 8.0 and FortiClient Mac 7.2 are unaffected. The same release included 89 advisories covering nearly 100 issues, about 17 critical; Fortinet says none are known exploited.

Key facts
  • Advisory FG-IR-26-194 covers CVE-2026-121529, rated CWE-346 and CVSS 9.1.
  • Fixed versions are 7.4.8 and 7.2.15; Fortinet offers no virtual patch.
  • Windows clues are TCP port 9191 and FortiVRS.exe, not proof of attack.
  • SecurityWeek counts 89 advisories, about 17 critical and nearly 80 high.
  • Fortinet links the advisory volume to AI-assisted product security testing.
  • Technical details are public; Fortinet reports no known exploitation.
Analyze CVE-2026-121529 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 10, 2026Fortinet published FG-IR-26-194 for CVE-2026-121529 · GBHackers

What each outlet adds

beyond the shared facts
  • Cyber Security NewsFixed versions, CWE-346, and Windows port 9191 clue.
  • SecurityWeekBroader 89-advisory wave, FortiPAM requirement, and AI testing link.
  • GBHackersNames advisory FG-IR-26-194, dated November 10.
CVEs
CVE-2026-121529
Vendors
Fortinet
Products
FortiClientFortiPAMFortiClient MacFortiClient WindowsFortiClient Windows PAMFortiMailFortiAuthenticatorFortiOSFortiManagerFortiAnalyzerFortiSASE
Organizations
Baldur Security

Coverage

oldest first · one row per article · UTC
  1. · 13h ago Cyber Security NewsFirst report

    FortiClient CORS flaw allows website-triggered RCE (CVE-2026-121529)

    Fortinet says the CVSS 9.1 bug is not known exploited; fixes are 7.4.8 and 7.2.15, with no virtual patch.

  2. · 8h ago SecurityWeek

    Fortinet patches nearly 100 vulnerabilities across its products

    About 17 fixes are critical, including code execution and authentication bypass, with no exploitation stated.

  3. · 7h ago GBHackers

    Fortinet patches FortiClient flaw that runs code from malicious sites

    CVE-2026-121529 affects FortiClient 7.2 and 7.4 branches; Fortinet says exploitation is not known.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-121529
Origin validation error in Fortinet FortiClient (user interaction)
9.6—PoC