---
id: "CVE-2026-121529"
page: "https://infrastack.ai/live/CVE-2026-121529"
kind: "vulnerability"
aliases: ["CVE-2026-121529"]
title: "Fortinet FortiClient: origin validation flaw lets remote attacker run code"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiClientMac", "fixed": ["7.4.8"], "affected": ">= 7.4.0, <= 7.4.7", "ecosystem": "vendor"}, {"name": "FortiClientWindows", "fixed": ["7.4.8", "7.2.15"], "affected": ">= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.14", "ecosystem": "vendor"}, {"name": "FortiClientWindowsPAM", "fixed": ["7.4.8", "7.2.15"], "affected": ">= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.14", "ecosystem": "vendor"}]
ecosystems: []
tags: ["endpoint", "forticlient", "fortinet", "macos", "user-interaction", "vendor", "windows"]
not_affected_if: ["forticlient-8.0", "forticlient-mac-7.2"]
published_at: "2026-11-10T20:18:56+00:00"
first_seen_at: "2026-11-10T20:46:04+00:00"
updated_at: "2026-11-10T20:49:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121529", "first_seen_at": "2026-11-10T20:46:04+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-194", "first_seen_at": "2026-11-10T20:49:55+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-194"]}]
exploit_sources: []
---

# Fortinet FortiClient: origin validation flaw lets remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-121529 (this .md is for agents)

FortiClient for macOS and Windows fails to validate request origin, so a remote attacker can get unauthorized code or command execution. The attack needs the victim to interact with a crafted page or action.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiClientMac affected >= 7.4.0, <= 7.4.7 fixed 7.4.8
- vendor:FortiClientWindows affected >= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.14 fixed 7.4.8, 7.2.15
- vendor:FortiClientWindowsPAM affected >= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.14 fixed 7.4.8, 7.2.15

## How to check

Check the installed FortiClient version on each Mac and Windows endpoint (FortiClient About page). Affected per FortiGuard FG-IR-26-194: FortiClientMac 7.4.0-7.4.7; FortiClientWindows 7.4.0-7.4.7 and 7.2.0-7.2.14; FortiClientWindowsPAM 7.4.0-7.4.7 and 7.2.0-7.2.14. FortiClient 8.0 is not affected. The flaw is in a local API endpoint.

## Fix

Upgrade FortiClient (Mac, Windows, Windows PAM) 7.4.x to 7.4.8 or above; FortiClient Windows and Windows PAM 7.2.x to 7.2.15 or above. 8.0 is not affected; FortiClientMac 7.2 is not affected.

## Timeline

- 2026-11-10T20:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121529
- 2026-11-10T20:49:55+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-194 — Read FortiGuard FG-IR-26-194 (published 2026-11-10): fixes 7.4.8 / 7.2.15, not exploited per vendor, CWE-346 local API endpoint, reporter Baldur Security. Vendor CVSS is 9.1 (NVD shows 9.6); PAM ranges are 7.4.0-7.4.7 and 7.2.0-7.2.14, wider than NVD's. No mitigations or workaround listed. No social search: advisory is hours old.

## Documents

- [advisory] FG-IR-26-194 Origin validation error in local API endpoint https://fortiguard.fortinet.com/psirt/FG-IR-26-194

## From the sources

A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_