FORTICLIENTMAC · CVE-2026-121529 · Vendor
FIX → 7.4.8 · 7.2.15 ✓ verified
FortiClient for macOS and Windows fails to validate request origin, so a remote attacker can get unauthorized code or command execution. The attack needs the victim to interact with a crafted page or action.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiClient on Windows (including the PAM component) or macOS on 7.4.0-7.4.7, or on Windows 7.2.0-7.2.14. A remote attacker needs a user to interact with something crafted, and then could run code or commands on the endpoint. Fortinet says the flaw is in a local API endpoint. Teams on FortiClient 8.0, or on 7.2 for Mac, can skip it.
Not affected if forticlient-8.0, forticlient-mac-7.2
Who cares endpoint, forticlient, fortinet, macos, user-interaction, windows
A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
7.4.0-7.4.77.4.0-7.4.77.2.0-7.2.147.4.0-7.4.77.2.0-7.2.14Upgrade to 7.4.8 · 7.2.15
Upgrade FortiClient (Mac, Windows, Windows PAM) 7.4.x to 7.4.8 or above; FortiClient Windows and Windows PAM 7.2.x to 7.2.15 or above. 8.0 is not affected; FortiClientMac 7.2 is not affected.