{"id":"CVE-2026-121527","kind":"vulnerability","aliases":["CVE-2026-121527"],"related":[],"title":"Fortinet FortiClientEMS: local admin can gain root shell via CLI","description":"A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands.","summary":"FortiClientEMS versions 7.4.0 through 7.4.7 and all 7.2 releases run a CLI command path with unnecessary privileges. An authenticated local user with admin rights can use CLI commands to get a root shell on the server.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forticlientems","fortinet","self-hosted","vendor","windows"],"not_affected_if":["no-admin-access-to-ems"],"how_to_check":"- Confirm the installed FortiClientEMS version against the affected ranges (7.4.0 through 7.4.7, and 7.2 all versions).","fix":null,"status":"open","published_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:34:00+00:00","updated_at":"2026-11-11T22:34:00+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:34:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Fortinet FortiClientEMS: local admin can gain root shell via CLI","impact":"high","summary":"FortiClientEMS versions 7.4.0 through 7.4.7 and all 7.2 releases run a CLI command path with unnecessary privileges. An authenticated local user with admin rights can use CLI commands to get a root shell on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","forticlientems","self-hosted","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local admin gains root shell on the EMS server","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-121527 to confirm fixed versions and whether a setting or patch addresses the CLI path.","how_to_check":"- Confirm the installed FortiClientEMS version against the affected ranges (7.4.0 through 7.4.7, and 7.2 all versions).\n- unknown for other checks; the sources do not say which CLI commands or settings are involved.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-access-to-ems"],"who_is_affected":"Organisations running FortiClientEMS 7.4.0 through 7.4.7 or any 7.2 release. Exposure requires an account with admin privileges on the EMS server, so the risk is mainly from insiders or someone who has already compromised an admin login. The sources do not say whether specific configurations change exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4588,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121527':13A,16A '-2026':12A,15A '7.2':31B,77C '7.4.0':26B,73C '7.4.1':75C '7.4.3':69C '7.4.7':28B,71C 'access':93C 'admin':4A,46B,87C 'allow':81C 'attack':85C 'authent':42B,83C 'cli':10A,35B,50B,95C 'command':36B,51B,96C 'cve':11A,14A 'execut':61C 'forticlientem':2A,17B,24B,68C,72C,76C 'fortinet':1A,18B,67C 'gain':6A,90C 'get':53B 'host':21B 'local':3A,43B,84C 'may':80C 'path':37B 'privileg':40B,64C,88C 'releas':32B 'right':47B 'root':7A,55B,91C 'run':33B 'self':20B 'self-host':19B 'server':59B 'shell':8A,56B,92C 'unnecessari':39B,63C 'use':49B 'user':44B 'vendor':22B 'version':25B,79C 'via':9A,94C 'vulner':65C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Organisations running FortiClientEMS 7.4.0 through 7.4.7 or any 7.2 release. Exposure requires an account with admin privileges on the EMS server, so the risk is mainly from insiders or someone who has already compromised an admin login. The sources do not say whether specific configurations change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["forticlientems","fortinet","medium","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-121527':13A,16A '-2026':12A,15A 'admin':4A 'cli':10A 'cve':11A,14A 'forticlientem':2A 'fortinet':1A 'gain':6A 'local':3A 'root':7A 'shell':8A 'via':9A","search_b":"'7.2':31B '7.4.0':26B '7.4.7':28B 'admin':46B 'authent':42B 'cli':35B,50B 'command':36B,51B 'forticlientem':17B,24B 'fortinet':18B 'get':53B 'host':21B 'local':43B 'path':37B 'privileg':40B 'releas':32B 'right':47B 'root':55B 'run':33B 'self':20B 'self-host':19B 'server':59B 'shell':56B 'unnecessari':39B 'use':49B 'user':44B 'vendor':22B 'version':25B 'window':23B","search_c":"'7.2':77C '7.4.0':73C '7.4.1':75C '7.4.3':69C '7.4.7':71C 'access':93C 'admin':87C 'allow':81C 'attack':85C 'authent':83C 'cli':95C 'command':96C 'execut':61C 'forticlientem':68C,72C,76C 'fortinet':67C 'gain':90C 'local':84C 'may':80C 'privileg':64C,88C 'root':91C 'shell':92C 'unnecessari':63C 'version':79C 'via':94C 'vulner':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121527","severity":null,"published_at":"2026-11-11T22:17:11+00:00","modified_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}