FortiClient CORS flaw allows website-triggered RCE (CVE-2026-121529)
Fortinet says the CVSS 9.1 bug is not known exploited; fixes are 7.4.8 and 7.2.15, with no virtual patch.
1
Stories per day · 30 days
Relatedfortinet3cors2endpoint2authentication-bypass1fortimail1fortios1fortipam1privilege-escalation1remote-code-execution1
3 stories, newest first · one card per story
Stories tagged #forticlient
Arbitrary process termination from exposed minifilter communication port
Fortinet FortiClient Windows fortimon3 driver flaw (CVSS 4.7) lets authenticated attackers terminate arbitrary processes via exposed minifilter communication port.
Heap overflow in kernel driver due to missing size validation
Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.