Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-121529 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Fortinet |
| Product | FortiClientMac |
| Vulnerability Type | origin validation error (CWE-346) |
| CVSS Score | 9.6 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7 and FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.
Required Actions
- Update FortiClient (macOS and Windows, including the PAM variant) to the version listed in Fortinet advisory FG-IR-26-194 — ideally centrally via EMS.
- Inventory endpoints running FortiClient, including remote workers’ laptops that rarely connect to the corporate network.
- Until updated, warn users about unexpected links and prompts in the VPN client.
Who Is Affected?
The vulnerability affects Fortinet FortiClient on macOS (7.4.0–7.4.7) and Windows (7.2.0–7.2.14, 7.4.0–7.4.7) as well as FortiClientWindowsPAM. FortiClient is a widely deployed VPN/ZTNA client and EMS agent — every endpoint with a vulnerable version is exposed.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-121529 vulnerability?
CVE-2026-121529 is an origin validation error (CWE-346) in Fortinet FortiClient for macOS and Windows that can lead to remote execution of code or commands. CVSS score: 9.6.
Does exploiting CVE-2026-121529 require authentication?
No authentication is required, but a successful attack needs victim interaction (e.g. opening crafted content).
How to protect against CVE-2026-121529?
Update FortiClient to the version listed in advisory FG-IR-26-194, ideally centrally via FortiClient EMS.
Who is affected by CVE-2026-121529?
Users of FortiClientMac 7.4.0–7.4.7, FortiClientWindows 7.2.0–7.2.14 and 7.4.0–7.4.7, and FortiClientWindowsPAM 7.2.14 and 7.4.7.
