Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11154 | Publication Date: 15 November 2026

Origin Validation Error in FortiClient Leading to Remote Code Execution
CVE-2026-121529 (Fortinet2Shell)

Summary

A critical origin validation error has been identified in Fortinet FortiClient for Windows, macOS, and Windows PAM. Tracked as CVE-2026-121529 (also referred to in the security community as “Fortinet2Shell”), the vulnerability may allow an unauthorized remote attacker to execute unauthorized code or commands on the affected endpoint.

The issue has been assigned a CVSS v3.1 score of up to 9.6 (Critical). Successful exploitation requires interaction with the victim (for example, visiting a crafted web page). Fixed builds were published under Fortinet advisory FG-IR-26-194.

Technical Overview

FortiClient exposes a local API endpoint that did not properly validate the origin of incoming requests (CWE-346 – Origin Validation Error). Due to insufficient origin / CORS checks, a malicious web page opened in the victim’s browser can communicate with this local API and trigger code or command execution on the host.

No authentication to FortiClient is required. The attack is initiated from the network (via the victim’s browser) and the impact extends to the confidentiality, integrity, and availability of the endpoint. FortiClient EMS and the FortiClient Free VPN agent are not affected by this specific vulnerability.

Affected Systems

• FortiClient Windows 7.4: 7.4.0 through 7.4.7
• FortiClient Windows 7.2: 7.2.0 through 7.2.14
• FortiClient macOS 7.4: 7.4.0 through 7.4.7
• FortiClient Windows PAM 7.4: through 7.4.7
• FortiClient Windows PAM 7.2: through 7.2.14

Fixed versions:

• FortiClient Windows / Windows PAM 7.4: 7.4.8 or later
• FortiClient Windows / Windows PAM 7.2: 7.2.15 or later
• FortiClient macOS 7.4: 7.4.8 or later
• Branch 8.0 is not affected

FortiClient EMS and FortiClient Free VPN are not affected. Refer to Fortinet PSIRT advisory FG-IR-26-194 for official details.

Exploitation Status

• Public disclosure on 10 November 2026 (FG-IR-26-194).
• Requires user interaction (e.g., opening a crafted page in a browser).
• Public discussion and proof-of-concept references exist in the security community.
• No widespread in-the-wild exploitation confirmed as of this advisory’s publication.
• Not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.
• Fortinet has not provided a virtual patch; endpoint upgrade is required.

Recommendations

1. Immediate Action: Upgrade all affected FortiClient agents to the fixed version for their branch (7.4.8+ or 7.2.15+ as applicable, or move to 8.0 where supported).
2. Inventory FortiClient deployments across the organization (Windows, macOS, and Windows PAM) and confirm installed versions via EMS or endpoint management tools.
3. Prioritize endpoints used by high-privilege users, remote workers, and systems that frequently browse untrusted web content.
4. Ensure update deployment is verified on the endpoint itself; updating FortiGate or EMS alone does not remediate the client vulnerability.
5. Remind users not to open unexpected links or visit untrusted websites while FortiClient is running, until the patch is fully rolled out.
6. Review endpoint and browser logs for unusual activity around local FortiClient API endpoints if compromise is suspected.
7. If compromise is suspected, isolate the endpoint, preserve forensic evidence, rotate credentials accessible from that system, and perform a full integrity review before returning it to service.

Because FortiClient is widely deployed as a corporate VPN and endpoint security agent, organizations should treat this as a high-priority endpoint update, especially for user populations that regularly access the internet.

Karen IT
We make the Internet harder to abuse.