L3 · ShartedFortinet · FortiClient · endpointforticlient-local-api

FortiClient local API lets a malicious webpage reach code execution

CVE-2026-121529 lets a remote attacker execute code or commands through FortiClient’s local API when a victim interacts with attacker-controlled content. The discoverer reproduced it with FortiPAM enabled.

Disclosed: Nov 10, 2026; Public disclosure date
Severity: CVSS 9.1; 1 CVE tracked here
Splash zone: Affected FortiClient Mac, Windows and Windows PAM builds. The browser path was demonstrated with FortiPAM enabled.; Fortinet · FortiClient · endpoint
In the wild: Unknown; The discoverer reproduced the flaw. In-the-wild exploitation remains unconfirmed.

What happened

Fortinet disclosed an origin validation flaw in the FortiClient local API. The discoverer demonstrated that a malicious web page could reach the local service and execute code on a workstation with FortiPAM enabled. The attacker needs victim interaction. An inbound connection to the workstation from the internet is unnecessary for the demonstrated browser path.

Fortinet’s CVE record lists Mac 7.4.0–7.4.7, Windows 7.4.0–7.4.7 and 7.2.0–7.2.14, and Windows PAM builds 7.4.7 and 7.2.14. The discoverer and CSIRT Panamá list a wider range for Windows PAM, 7.4.0–7.4.7 and 7.2.0–7.2.14. Apply the published updates across the wider Windows PAM ranges while confirming edition and branch with Fortinet. The Windows listener and process described by the discoverer can flag an installation for version checks. An investigation of endpoint activity is needed to establish compromise.

What’s in the bowl

CVE-2026-121529CVSS 9.1

Local API origin validation error

An unauthenticated remote attacker can execute code or commands through the local API with victim interaction.

Fixed versions

Product	Safe from	Note
FortiClient Mac, Windows and Windows PAM 7.4	`7.4.8`
FortiClient Windows and Windows PAM 7.2	`7.2.15`

Crime-scene timeline

Nov 10, 2026
Fortinet discloses the FortiClient local API flaw
FG-IR-26-194 and the Fortinet CVE record describe code execution that requires victim interaction.
Nov 11, 2026
CSIRT Panamá publishes the update matrix
The alert lists 7.4.8 for Windows, Windows PAM and Mac, and 7.2.15 for Windows and Windows PAM.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Fortinet CNA recordPrimaryVendor-submitted disclosure gives the interaction requirement, 9.1 score and narrower Windows PAM list.
Kevin Joensen’s original disclosurePrimaryThe discoverer describes the browser-to-local-service path with FortiPAM enabled, Windows exposure indicators and a wider Windows PAM range.
CSIRT Panamá advisoryPublic CERT alert reproduces the patch matrix and the vendor’s exploitation status at disclosure.

Wipe guide

The wipe checklist

0 of 3 sheets used

Inventory and upgrade affected endpointsUse FortiClient EMS or endpoint inventory to identify OS, edition, branch and build. Upgrade affected Mac, Windows and Windows PAM 7.4 installs to 7.4.8 or later and affected Windows and Windows PAM 7.2 installs to 7.2.15 or later. Verify each endpoint’s installed version after rollout.
Check Windows exposure signalsThe discoverer suggests looking for a listener on TCP 9191 and a running FortiVRS.exe. Treat them as exposure signals. Their presence alone does not prove compromise, and absence does not replace checking the installed build.
Investigate suspicious endpoint activityWhile rolling out updates, prioritize FortiPAM workstations and investigate suspicious browsing followed by unexpected process launches or commands from the local FortiClient service. Isolate affected hosts, retain browser and endpoint telemetry and revoke credentials accessible to a compromised host.