Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled
Fortinet warns of critical FortiClient RCE flaw CVE-2026-121529, CVSS 9.1, affecting Mac and Windows.
Fortinet has issued a warning about a critical vulnerability, CVE-2026-121529, in FortiClient that allows remote code execution on user machines with a CVSS score of 9.1. The flaw, identified as an origin validation error (CWE-346) due to a loose CORS misconfiguration, enables an attacker to send requests to a local service running on the victim's machine by having the user visit a malicious website. The vulnerability affects FortiClient on Mac and Windows, including PAM versions, with specific build ranges listed. The fix involves upgrading to patched versions, such as 7.4.8 or later for the 7.4 branch and 7.2.15 or later for the 7.2 branch. Indicators of a vulnerable setup on Windows include a service listening on TCP port 9191 or a running FortiVRS.exe process, though these do not confirm an attack.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fortinet?
Get an email when a new story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability (CVE-2026-121529) in FortiClient stems from an overly permissive CORS (Cross-Origin Resource Sharing) configuration, classified as an origin validation error (CWE-346). This misconfiguration allows a malicious website to send unauthorized requests to a local service running on TCP port 9191 on the victim's machine, triggering remote code execution without requiring direct network access. The flaw is especially dangerous because exploitation requires only that the user visit a malicious webpage — a low barrier for attackers. This incident highlights how insecure default or loose service configurations in security software can paradoxically become a critical attack surface. Organizations must treat local service configurations in endpoint security tools with the same rigor applied to internet-facing services.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-121529