What happened

On November 10, 2026, Fortinet published advisory FG-IR-26-194 for CVE-2026-121529, an origin validation error (CWE-346) in a local API endpoint of FortiClient for Mac, FortiClient for Windows and the FortiClient Windows PAM agent. Fortinet rates it Critical, CVSS 9.1, describes it as exploitable by an unauthenticated remote attacker who needs the victim to interact with something, and lists it as not known to be exploited.

The researcher who reported it, from Baldur Security, calls it Fortinet2Shell. In the researcher's words the root cause is a CORS misconfiguration that lets an attacker-controlled web page talk to a local service and run code. In practice the user only has to load a malicious page in a browser. According to the researcher the flaw is exploitable when FortiPAM functionality is enabled. The exact vulnerable route and payload have not been published.

Fortinet lists these affected and fixed versions:

  • FortiClient 7.4.0 through 7.4.7 (Mac, Windows, Windows PAM): upgrade to 7.4.8 or above
  • FortiClient 7.2.0 through 7.2.14 (Windows, Windows PAM): upgrade to 7.2.15 or above
  • FortiClient 8.0, and FortiClient Mac 7.2: not affected

The fix arrived in a very large release. SecurityWeek reports Fortinet published 89 advisories covering nearly 100 vulnerabilities, about 17 of them critical, mostly in FortiMail, FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer, with no exploitation mentioned.

Why it matters

This is a security agent that runs on every managed laptop, and the weakness sits behind a port that only the local machine should be able to reach. A web page is not local, but the browser is, and that is the bridge the flaw uses. No attachment, macro or installer is needed.

The risk is highest on privileged administrator workstations that have FortiClient with PAM features, because they browse the web and hold credentials worth stealing. Nobody has reported exploitation so far. Public naming and a clear root cause tend to speed up exploit development, so treat the patch window as short.

What defenders should check

  • Inventory FortiClient versions across Windows and Mac endpoints. Anything in 7.4.0 to 7.4.7 or 7.2.0 to 7.2.14 needs the fix.
  • Find out where FortiPAM or the PAM agent is deployed and patch those machines first.
  • Check Windows endpoints for a listener on TCP 9191 and a running FortiVRS.exe. Public write-ups name both as signs the vulnerable service is present. Neither proves a compromise.
  • Confirm that fixed builds are actually installed, not just that a deployment job ran.

Detection ideas

These are starting points to adapt and test in your own environment, not finished detections.

PowerShell, on a single endpoint, to see the listener and the version:

Get-NetTCPConnection -LocalPort 9191 -State Listen -ErrorAction SilentlyContinue
Get-Process FortiVRS -ErrorAction SilentlyContinue
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object DisplayName -like "FortiClient*" | Select-Object DisplayName, DisplayVersion

Microsoft Defender for Endpoint (KQL), shells or script hosts started by Fortinet processes:

DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName startswith "Forti"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine

Also look for a browser connecting to the local port shortly before an unexpected child process appears, and for FortiClient components writing new files outside their install folder.

Investigation

If an endpoint looks suspicious, collect before you remediate: a memory image, the browser history and cache for the hours before the event, the process tree around the Fortinet service, and Defender or EDR telemetry. Check whether the machine held privileged sessions or stored credentials, because the code would have run with the agent's rights. Reset credentials that were reachable from that machine. Our incident response team uses this order of work.

Mitigation

  • Upgrade FortiClient to 7.4.8 or 7.2.15, or move to 8.0, which Fortinet lists as not affected.
  • Fortinet's advisory lists no workaround, so patching is the control.
  • Until patched, reduce exposure: limit web browsing from privileged administrator workstations, and alert on the local service port and on shells started by Fortinet processes.
  • Review the rest of the November Fortinet advisories for products you run, since several others are rated critical.

Source: Fortinet PSIRT advisory FG-IR-26-194, with context from SecurityWeek's report on the November release.