---
id: "CVE-2026-121527"
page: "https://infrastack.ai/live/CVE-2026-121527"
kind: "vulnerability"
aliases: ["CVE-2026-121527"]
title: "Fortinet FortiClientEMS: local admin can gain root shell via CLI"
severity: "medium"
cvss: 6.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["forticlientems", "fortinet", "self-hosted", "vendor", "windows"]
not_affected_if: ["no-admin-access-to-ems"]
published_at: "2026-11-11T22:17:11+00:00"
first_seen_at: "2026-11-11T22:29:27+00:00"
updated_at: "2026-11-11T22:34:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121527", "first_seen_at": "2026-11-11T22:29:27+00:00"}]
exploit_sources: []
---

# Fortinet FortiClientEMS: local admin can gain root shell via CLI

Link for people: https://infrastack.ai/live/CVE-2026-121527 (this .md is for agents)

FortiClientEMS versions 7.4.0 through 7.4.7 and all 7.2 releases run a CLI command path with unnecessary privileges. An authenticated local user with admin rights can use CLI commands to get a root shell on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed FortiClientEMS version against the affected ranges (7.4.0 through 7.4.7, and 7.2 all versions).

## Timeline

- 2026-11-11T22:29:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121527

## From the sources

A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_