# FortiClient: crafted interactions can lead to code execution

Canonical: https://www.oktsec.com/radar/forticlient-local-api-cve-2026-121529
Publisher: Oktsec
Language: en
Published: 2026-11-13T04:54:59Z
Updated: 2026-11-13T04:54:59Z
Record reviewed: 2026-11-13T04:54:59Z
Latest evidence check: 2026-11-13T04:54:59Z
Disclosed: 2026-11-10

Fortinet confirms a local API origin validation flaw in affected FortiClient editions. Exploitation requires user interaction; Windows Free VPN is not affected, and Fortinet reports no known exploitation.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Review this week
- Rationale: Code execution requires victim interaction. Fortinet publishes corrections and reports no known exploitation; edition and branch determine whether an endpoint is affected.
- Evidence: No attacks reported
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: Fortinet
- Products: FortiClient Mac, FortiClient Windows, FortiClient Windows PAM
- CVEs: CVE-2026-121529

## Technical overview

Fortinet’s November 10 advisory describes an origin validation error in a local API endpoint. An unauthorized remote attacker can execute code or commands through a crafted interaction with a victim. This is an endpoint client issue, not a claim that an Internet exposed VPN server can be compromised without user interaction.

The PSIRT table and its linked CSAF document agree: Mac 7.4.0 through 7.4.7 needs 7.4.8; Windows and Windows PAM need 7.4.8 for affected 7.4 releases or 7.2.15 for affected 7.2 releases. The listed 8.0 branches, Mac 7.2 and FortiClient Windows Free VPN are not affected.

The CNA record lists only PAM 7.4.7 and 7.2.14, while PSIRT and CSAF give the full affected branch ranges. This advisory follows the detailed vendor remediation tables; the narrower CNA entries must not be used to clear earlier PAM installations. Numeric CVSS is omitted because the published score and vector are inconsistent.

Fortinet reports no known exploitation. That is the vendor’s status at review, not proof that attacks cannot occur. Oktsec recommends checking the running version on endpoints, verifying that deployment reached offline devices, and investigating suspicious interactions or alerts separately from patch completion.

## Recommended response

Update affected 7.4 clients to 7.4.8 or later; update Windows and Windows PAM 7.2 clients to 7.2.15 or later. Check the edition and running version on each endpoint, not only the deployment console.

Relevant to: Teams managing FortiClient Mac, Windows and Windows PAM endpoints.

## CVE attribution

- CVE-2026-121529: Fortinet — FortiClient Mac, FortiClient Windows, FortiClient Windows PAM. [Source](https://filestore.fortinet.com/fortiguard/psirt/csaf_origin-validation-error-in-local-api-endpoint_fg-ir-26-194.json)

## Affected systems and fixes

### FortiClient Mac 7.4

Affected: 7.4.0 through 7.4.7

Fixed release / action: 7.4.8 or later in this branch

### FortiClient Windows 7.4

Affected: 7.4.0 through 7.4.7

Fixed release / action: 7.4.8 or later in this branch

### FortiClient Windows 7.2

Affected: 7.2.0 through 7.2.14

Fixed release / action: 7.2.15 or later in this branch

### FortiClient Windows PAM 7.4

Affected: 7.4.0 through 7.4.7, per PSIRT and CSAF

Fixed release / action: 7.4.8 or later in this branch

### FortiClient Windows PAM 7.2

Affected: 7.2.0 through 7.2.14, per PSIRT and CSAF

Fixed release / action: 7.2.15 or later in this branch

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.10
Checked: 2026-11-13T11:52:40.573Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-13T11:52:40.899Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-121529](https://api.first.org/data/v1/epss?cve=CVE-2026-121529): 0.22% probability of observed exploitation in the next 30 days; percentile 12.39%; score date 2026-11-12.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T11:52:40.899Z.

### Official regional advisories

- [CSIRT Panamá Aviso 2026-nov-11: Vulnerabilidad Crítica en FortiClient (Mac, Windows y Windows PAM) permite ejecución de código o comandos no autorizados — CVE-2026-121529](https://cert.pa/?p=6288) — CSIRT Panamá, Panama; publication 2026-11-11; observed 2026-11-13T11:52:40.899Z; matched by exact CVE identifier.

Publisher country does not establish victim location. Original notices may repeat the same underlying advisory.

## Response checklist

1. **Identify the edition, platform and branch** — Inventory FortiClient Mac, Windows and Windows PAM separately. Fortinet lists their 8.0 branches, Mac 7.2 and Windows Free VPN as unaffected; do not apply this exception to every VPN client.
2. **Deploy the correction and verify endpoints** — Install 7.4.8 or later in affected 7.4 branches. For Windows and Windows PAM 7.2, install 7.2.15 or later in that branch. Verify the active endpoint version after deployment.
3. **Limit suspicious interactions and review alerts** — Oktsec recommends warning users against unexpected prompts and reviewing endpoint detections where suspicious interactions occurred. User awareness complements patching; it is not the correction.

## Relevance to AI environments

Oktsec recommends including endpoint security clients in the inventory of workstations used for AI development and operations; this vulnerability is not specific to AI.

## Sources

- [Fortinet PSIRT: scope, fixes and exploitation status](https://www.fortiguard.com/psirt/FG-IR-26-194) — Fortinet; Vendor notice; checked 2026-11-13T04:54:59Z
- [Fortinet CSAF: affected and unaffected editions with branch corrections](https://filestore.fortinet.com/fortiguard/psirt/csaf_origin-validation-error-in-local-api-endpoint_fg-ir-26-194.json) — Fortinet PSIRT; Vendor notice; checked 2026-11-13T04:54:59Z
- [Fortinet CNA record: narrower PAM entries differ from the PSIRT table](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121529.json) — Fortinet (CNA record); Vendor notice; checked 2026-11-13T04:54:59Z

## Editorial record

- 2026-11-13T04:54:59Z: Added Fortinet PSIRT and CSAF scope, branch corrections, unaffected editions and the user interaction prerequisite. The narrower PAM entries in the CNA record are identified separately.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/forticlient-local-api-cve-2026-121529) · [Build a response plan](https://www.oktsec.com/radar/forticlient-local-api-cve-2026-121529#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=forticlient-local-api-cve-2026-121529&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=forticlient-local-api-cve-2026-121529&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.