CriticalFortinet CVSSv3 9.1 / NVD 9.6Needs user interactionFortiClient

Is your FortiClient estate exposed to CVE-2026-121529?

Fortinet published FG-IR-26-194 on 10 November 2026 for CVE-2026-121529, a Critical origin validation error in FortiClient's local API endpoint. Fortinet's CVSSv3 score is 9.1; the NVD record shows 9.6 on Fortinet's base vector. Exploitation needs user interaction; Fortinet does not say what that interaction is. Update to 7.4.8 or later, or 7.2.15 or later on Windows and Windows PAM 7.2.

Fortinet says it is not known exploited. Not in CISA KEV when checked on 10 November 2026

Fortinet's advisory FG-IR-26-194 lists Known Exploited: No. CVE-2026-121529 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 21:02 GMT on 10 November 2026 (catalogue 2026.11.10, released at 19:03 UTC, before this advisory). Recheck KEV. Successful exploitation requires interaction with the victim; Fortinet does not say what that interaction is. Upgrade affected FortiClient 7.4 releases to 7.4.8 or above, and affected Windows and Windows PAM 7.2 releases to 7.2.15 or above.

By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 21:24 GMT.

Check Exposure How to Hunt

At a Glance

Based on Fortinet advisory FG-IR-26-194, the official CVE record and NVD, and CISA KEV, as of 10 November 2026. Last updated 10 November 2026, 21:24 GMT.

Severity

Critical, 9.1 and 9.6

Fortinet rates it Critical. Fortinet's advisory and the CVE record (CNA: Fortinet) list CVSSv3 9.1. The NVD record shows 9.6 on Fortinet's base vector. Needs user interaction (UI:R).

Status

Not known exploited

Fortinet lists Known Exploited: No. Not in CISA KEV when checked at 21:02 GMT on 10 November 2026 (catalogue 2026.11.10, which predates this advisory).

Affected

Windows, Windows PAM and Mac

FortiClient Windows and Windows PAM 7.4.0 through 7.4.7 and 7.2.0 through 7.2.14, and FortiClient Mac 7.4.0 through 7.4.7. 8.0 and Mac 7.2 are not affected.

Fix

7.4.8 or 7.2.15

Fortinet: upgrade 7.4 to 7.4.8 or above, and Windows and Windows PAM 7.2 to 7.2.15 or above. No virtual patch and no workaround listed.

10 Nov

Fortinet publishes FG-IR-26-194 for CVE-2026-121529, rates it Critical, lists CVSSv3 9.1, and says Known Exploited: No.

10 Nov

The official CVE record (CNA: Fortinet) and the NVD record are published. NVD, in Received status, shows 9.6 on Fortinet's base vector.

10 Nov 21:02 GMT

CVE-2026-121529 is not in CISA KEV catalogue 2026.11.10 (released at 19:03 UTC, before this advisory). Recheck KEV.

Now

Upgrade affected FortiClient 7.4 releases to 7.4.8 or above, and affected Windows and Windows PAM 7.2 releases to 7.2.15 or above.

Affected and fixed versions (FG-IR-26-194)

The table follows Fortinet's advisory. Fortinet lists only FortiClient Mac, FortiClient Windows and FortiClient Windows PAM. The official CVE record and the NVD record describe FortiClient Windows PAM as 7.4.7 and 7.2.14 only; we follow the advisory's PAM ranges, 7.4.0 through 7.4.7 and 7.2.0 through 7.2.14. Scores: Fortinet's advisory and the official CVE record both give CVSSv3 9.1 (vector with temporal metrics E:P/RL:O/RC:C). NVD has not scored it (Received status when we checked on 10 November 2026) and shows 9.6 on the base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, credited to Fortinet. Fortinet's vector includes E:P, which indicates proof-of-concept code exists, but Fortinet says it is not known to be exploited.

Product (Fortinet)	Affected	Fortinet's solution
FortiClient Mac 7.4	7.4.0 through 7.4.7	Upgrade to 7.4.8 or above
FortiClient Mac 7.2	Not affected	Not applicable
FortiClient Mac 8.0	Not affected	Not applicable
FortiClient Windows 7.4	7.4.0 through 7.4.7	Upgrade to 7.4.8 or above
FortiClient Windows 7.2	7.2.0 through 7.2.14	Upgrade to 7.2.15 or above
FortiClient Windows 8.0	Not affected	Not applicable
FortiClient Windows PAM 7.4	7.4.0 through 7.4.7	Upgrade to 7.4.8 or above
FortiClient Windows PAM 7.2	7.2.0 through 7.2.14	Upgrade to 7.2.15 or above
FortiClient Windows PAM 8.0	Not affected	Not applicable

What to Do in the Next 24 Hours

Proactive on the left. Reactive on the right. Fortinet's advice and our advice are labelled separately.

Proactive

Update and inventory

Fortinet: upgrade affected 7.4 releases to 7.4.8 or above, and affected FortiClient Windows and Windows PAM 7.2 releases to 7.2.15 or above. See FG-IR-26-194. Fortinet lists no virtual patch and no workaround.
Our advice: use EMS or RMM to inventory every FortiClient Mac, Windows and Windows PAM install, including the exact version.
Our advice: push 7.4.8 or later, or 7.2.15 or later on Windows and Windows PAM 7.2, through EMS or RMM. Prioritise exposed or managed endpoints first.
Our advice: record 8.0 and FortiClient Mac 7.2 as not affected for this CVE, but still include them in the inventory so you know what is deployed.

Reactive

Hunt and contain

Our advice: Fortinet has published no indicators of compromise. Look for unexpected child processes of FortiClient.
Our advice: look for new or unexpected services or scheduled tasks around FortiClient on hosts that had a vulnerable build.
Our advice: look for unusual outbound connections from FortiClient processes.
Our advice: if anything looks off, isolate the host, collect EDR telemetry, apply the fixed FortiClient build, and rotate the user's credentials.

Proactive: Fortinet's Advice, Then Ours

Fortinet's upgrade first, then our advice for finding and pushing every install.

Step 1

Upgrade to 7.4.8 or 7.2.15

Fortinet: upgrade affected 7.4 releases to 7.4.8 or above, and affected FortiClient Windows and Windows PAM 7.2 releases to 7.2.15 or above. See Fortinet advisory FG-IR-26-194. Fortinet lists Virtual Patch: No, and does not publish a workaround.

Step 2

Inventory every FortiClient install

Our advice: use FortiClient EMS or your RMM to list every FortiClient Mac, Windows and Windows PAM install, with its version.

Step 3

Push the fixed builds

Our advice: push 7.4.8 or later, or 7.2.15 or later on Windows and Windows PAM 7.2, through EMS or RMM. Prioritise exposed or managed endpoints first, then the rest of the estate still on an affected build.

Step 4

Record what is not affected

Our advice: FortiClient 8.0, and FortiClient Mac 7.2, are not affected according to Fortinet. Still record those installs in the inventory so you know what is deployed, and do not treat them as requiring this particular upgrade.

Free Detection Pack

Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check FortiClient versions offline and hunt for signs of misuse. Everything is read-only.

Linux and macOS

check-forticlient.sh

Read-only offline checker. It compares the FortiClient version you give it, or a CSV inventory from EMS or RMM, against Fortinet's affected and fixed ranges in FG-IR-26-194, including the advisory's full Windows PAM ranges (7.4.0 through 7.4.7 and 7.2.0 through 7.2.14). It never contacts Fortinet or an endpoint.

bash check-forticlient.sh --platform windows --version 7.4.7 --name ws-01

bash check-forticlient.sh --inventory forticlient-inventory.csv

Download check-forticlient.sh

Windows

Check-FortiClient.ps1

The same checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.

pwsh -File Check-FortiClient.ps1 -Inventory forticlient-inventory.csv

Download Check-FortiClient.ps1 (.zip)

Hunting queries

KQL and Sigma

13 KQL hunts for Microsoft Defender and Sentinel (Q1, Q1b, Q1c, Q2, Q2b, Q3, Q3b, Q4, Q5, Q6, Q6b, Q7 and Q7b). Q1, Q1b, Q1c, Q2 and Q2b (macOS) are inventory. Q3, Q3b, Q4, Q5, Q6, Q6b, Q7 and Q7b are our patterns, not Fortinet's; Q7 and Q7b are macOS. 3 Sigma rules (win_proc_forticlient_shell_lolbin_child.yml, win_proc_forticlient_service_task_child.yml and macos_proc_forticlient_shell_child.yml) cover unexpected shell or LOLBin children of FortiClient on Windows, services or scheduled tasks created under a FortiClient parent, and unexpected shell children on macOS. Q5 learns the local API port from each tenant's telemetry, because Fortinet documents no port. Fortinet has published no indicators of compromise, and the pack contains none. None of the KQL has been run against a live tenant.

Download KQL (.zip) Download Sigma (.zip)

Verdicts

PATCHED7.4.8 or above in 7.4, or 7.2.15 or above in Windows or Windows PAM 7.2.
NOT AFFECTEDFortinet lists it as not affected: 8.0 on Windows, Windows PAM and Mac, and Mac 7.2.
VULNERABLEIn Fortinet's affected ranges in the advisory.
OUT OF RANGEA branch not listed by Fortinet (for example 7.0 or 6.x).
UNKNOWNA platform not listed by Fortinet (Linux, mobile, EMS), no platform, no version, or an unreadable version.

Exit codes

Code	Meaning
0	All PATCHED or NOT AFFECTED
1	Any VULNERABLE
2	Any OUT OF RANGE, none vulnerable
3	Any UNKNOWN, none vulnerable or out of range
4	Usage or read error

Inventory mode exits with the worst row. MSPs can use the exit code in RMM or scheduled jobs.

Know the limits

Both checkers are read-only and offline. They only compare the versions or CSV you give them, send no network traffic, write nothing and contain no exploit payloads. The checker follows the advisory's full Windows PAM ranges.
Fortinet has published no indicators of compromise, and the pack contains none. Q3, Q3b, Q4, Q5, Q6, Q6b, Q7 and Q7b are our own patterns. They do not detect the vulnerability itself.
None of the KQL has been run against a live tenant. Q5 learns the local API port from each tenant's telemetry, because Fortinet documents no port.

What is in the pack

File	What it does
check-forticlient.sh	Offline checker for Linux and macOS (bash)
Check-FortiClient.ps1	The same checker in PowerShell 7
KQL (13 hunts)	Microsoft Defender and Sentinel hunts Q1, Q1b, Q1c, Q2, Q2b, Q3, Q3b, Q4, Q5, Q6, Q6b, Q7 and Q7b
Sigma (3 rules)	win_proc_forticlient_shell_lolbin_child.yml, win_proc_forticlient_service_task_child.yml and macos_proc_forticlient_shell_child.yml, plus Kusto conversions (in the full pack)
tests/	Fixtures and tests (in the full pack)
README.md	Verified facts, Fortinet's advice versus ours, limits and usage (in the full pack)

Download the Full Pack (.zip)

Reactive: How to Hunt (Our Advice)

Fortinet has published no indicators of compromise, and the pack contains none. The hunts below, and pack queries Q3 to Q7b, are CybaVerse advice, our own patterns. None of the KQL has been run against a live tenant. CybaOps can run them across your estate or your clients'.

Hunt 1

Unexpected child processes of FortiClient

Our advice: look for unexpected child processes of FortiClient, especially shells or LOLBins, on hosts that had a vulnerable build.

Hunt 2

Unexpected services or scheduled tasks

Our advice: look for new or unexpected services or scheduled tasks around FortiClient on hosts that ran an affected version.

Hunt 3

Unusual outbound connections

Our advice: look for unusual outbound connections from FortiClient processes. Fortinet has published no IOCs, so this is a generic hunt, not a vendor indicator.

Hunt 4

If anything looks off

Our advice: isolate the host, keep EDR telemetry and logs, apply the fixed FortiClient build if it is still missing, rotate the user's credentials, and hunt neighbouring endpoints that were still on an affected version.

If you find signs of misuse (our advice)

Isolate the affected host. Keep it powered and keep the EDR telemetry and logs.
Upgrade FortiClient to 7.4.8 or above, or to 7.2.15 or above on Windows and Windows PAM 7.2.
Rotate the user's credentials, and review local services, scheduled tasks and child processes.
Hunt neighbouring Windows and Mac endpoints that were still on an affected FortiClient build.

Updated does not mean clean

Upgrading FortiClient stops new use of this flaw. It does not undo code execution, new services, scheduled tasks or credentials already misused. Hunt the period before you updated.

FortiClient CVE-2026-121529 FAQ

Short answers based on Fortinet advisory FG-IR-26-194, the official CVE record, NVD and CISA as of 10 November 2026.

What is CVE-2026-121529?

It is an origin validation error (CWE-346) in FortiClient's local API endpoint, published by Fortinet on 10 November 2026 as PSIRT advisory FG-IR-26-194. Fortinet says the flaw in FortiClient Mac, FortiClient Windows and FortiClient Windows PAM may allow an unauthorised remote attacker to execute unauthorised code or commands, and that successful exploitation requires interaction with the victim. Fortinet does not say what that interaction is, and we do not guess. Fortinet lists the impact as escalation of privilege, the component as API, and the attack type as unauthenticated. We follow the public advisory wording (local API endpoint) and do not add a more specific technical story than Fortinet published.

What is the severity, and why do the scores differ?

Fortinet rates CVE-2026-121529 Critical. Fortinet's advisory, and the official CVE record where Fortinet is the CNA, list a CVSSv3 score of 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (base metrics plus temporal metrics). The NVD record, which is in Received status and has not scored it, shows 9.6 Critical on the base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, credited to Fortinet (psirt@fortinet.com), without the temporal metrics. Fortinet's vector includes E:P, which indicates proof-of-concept code exists, but Fortinet says it is not known to be exploited. We state both scores and their sources, and we do not pick one as the only score.

Which versions are affected?

We follow Fortinet's FG-IR-26-194 table. Affected: FortiClient Mac 7.4.0 through 7.4.7; FortiClient Windows 7.4.0 through 7.4.7 and 7.2.0 through 7.2.14; FortiClient Windows PAM 7.4.0 through 7.4.7 and 7.2.0 through 7.2.14. Not affected: FortiClient Mac, Windows and Windows PAM 8.0, and FortiClient Mac 7.2. Fortinet's advisory lists only those products. The official CVE record and the NVD record describe FortiClient Windows PAM as 7.4.7 and 7.2.14 only; we follow the advisory's full PAM ranges (7.4.0 through 7.4.7 and 7.2.0 through 7.2.14).

How do we fix it?

Fortinet's advice is to upgrade affected 7.4 releases to 7.4.8 or above, and affected 7.2 Windows and Windows PAM releases to 7.2.15 or above. Fortinet lists no virtual patch (Virtual Patch: No) and does not publish a workaround. 8.0, and FortiClient Mac 7.2, are not affected, so this advisory does not require a change there. Our advice is to inventory every FortiClient Mac, Windows and Windows PAM install with EMS or RMM, then push the fixed builds, starting with exposed or managed endpoints.

Is it being exploited, or in CISA KEV?

Fortinet's advisory says Known Exploited: No. CVE-2026-121529 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 21:02 GMT on 10 November 2026. That catalogue (2026.11.10) was released at 19:03 UTC, before Fortinet published this advisory, so it predates the CVE and does not list it. Recheck KEV.

What user interaction is required?

Fortinet says successful exploitation requires interaction with the victim, and the CVSS vector includes UI:R. Fortinet does not say what that interaction is. We do not guess, and we do not describe an attack method beyond that wording.

Did Fortinet publish indicators of compromise or a virtual patch?

No. Fortinet's advisory lists Virtual Patch: No, and it does not include indicators of compromise. The hunts in the Reactive section, and pack queries Q3 to Q7b, are CybaVerse advice, our own patterns. None of the KQL has been run against a live tenant. Fortinet lists no indicators of compromise, and the pack contains none.

Who reported it?

Credited to security researchers; we do not name them.

Who is this relevant to?

MSPs and IT teams that deploy FortiClient on Windows or Mac, including FortiClient Windows PAM, especially estates managed through FortiClient EMS or another RMM. Check the versions in the table.

Protect Your Endpoints, and Your Clients'

CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.

Book a CybaOps demo