FortiClient 'Fortinet2Shell' CORS flaw (CVE-2026-121529) allows code execution via malicious websites
Fortinet published an advisory (FG-IR-26-194) on November 10, 2026 describing a critical CORS origin validation error (CWE-346) in FortiClient that can let a malicious website run code on a user’s machine. The flaw is tracked as CVE-2026-121529, was reported by Kevin Joensen of Baldur Security (nicknamed “Fortinet2Shell”), and Fortinet rates it Critical with a CVSS v3 score of 9.1. The vulnerability affects FortiClient Mac and FortiClient Windows (including Windows PAM) in the 7.4 and 7.2 branches (specific vulnerable ranges below); FortiClient 8.0 and FortiClient Mac 7.2 are not affected. Fortinet says exploitation requires user interaction (victim visiting a malicious web page) and is not known to be exploited in the wild. (gbhackers.com)
Entenda a falha
A vulnerabilidade
CVE-2026-121529 ("Fortinet2Shell", Fortinet advisory FG-IR-26-194) is a critical origin validation error (CWE-346), a CORS misconfiguration, in a local API endpoint of FortiClient. Fortinet rates it CVSS v3 9.1. An attacker needs no authentication, but the victim must visit a malicious web page. The result is arbitrary code execution on the victim's machine. Affected: FortiClient Mac 7.4.0-7.4.7, FortiClient Windows and Windows PAM 7.4.0-7.4.7, and FortiClient Windows and Windows PAM 7.2.0-7.2.14. Fixed in 7.4.8 and 7.2.15. Version 8.0 and FortiClient Mac 7.2 are not affected.
Como funciona
FortiClient runs a local service on the user's machine that exposes an API endpoint. When the user opens a web page controlled by an attacker, the page's script sends requests to that local service from the browser. The service should only accept requests from trusted origins, but it wrongly trusts requests coming from web pages. It therefore processes them and ends up running arbitrary code on the machine. Joensen says this works reliably when FortiPAM is enabled.
Por que é vulnerável
The root cause is a CORS misconfiguration, that is, missing or incorrect origin validation in the local API. The service assumes that requests reaching it are legitimate, so a website in the user's browser can talk to it as if it were a trusted local client. The articles do not explain why it went unnoticed. The fix is in the updated releases 7.4.8 and 7.2.15, and the articles do not detail what changed in the code. Fortinet says there is no virtual patch, so updating is the only mitigation.
Onde está
The articles name only a local API endpoint of FortiClient, with no file or function. On Windows, the hunting indicators are a service listening on TCP port 9191 and a running FortiVRS.exe process; details are in Fortinet advisory FG-IR-26-194.
Como foi descoberta
Researcher Kevin Joensen of Baldur Security reported the flaw and nicknamed it "Fortinet2Shell". Fortinet published advisory FG-IR-26-194 on November 10, 2026 together with the fixed releases. Fortinet says the flaw is not known to be exploited in the wild. The articles do not say how Joensen found it or when he reported it.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 12:27.
Detalhes técnicos
The advisory describes an origin validation/CORS misconfiguration in a local API endpoint run by FortiClient: a web page can send requests to that local service and trigger arbitrary code execution. The vendor lists the issue as unauthenticated with changed scope and escalation of privilege; the CVSS vector indicates network attack, low complexity, no privileges required, user interaction required and changed scope. Joensen reports the issue is particularly reliable when FortiPAM is enabled. Hunting indicators on Windows include a service listening on TCP port 9191 and a running FortiVRS.exe process. (gbhackers.com)
Detalhes da correção
Fortinet states there is no virtual patch; updating is the only mitigation. Upgrade FortiClient Mac and FortiClient Windows 7.4 to 7.4.8 or later, and FortiClient Windows 7.2 (and Windows PAM builds) to 7.2.15 or later. Version 8.0 and FortiClient Mac 7.2 are not affected. (gbhackers.com)
Remediação
Prioritize patching hosts running affected FortiClient 7.4.0–7.4.7 and 7.2.0–7.2.14 (Windows/PAM) to the fixed releases. While patching, hunt for the FortiClient Windows indicators (service on TCP port 9191 and FortiVRS.exe) and prioritize those systems. Advise users to avoid untrusted links and web pages until agents are updated. (gbhackers.com)
Linha do tempo
-
FortiClient 'Fortinet2Shell' CORS flaw (CVE-2026-121529) allows code execution via malicious websites
ler a análise desta fonte ocultar
Fortinet published an advisory (FG-IR-26-194) on November 10, 2026 describing a critical CORS origin validation error (CWE-346) in FortiClient that can let a malicious website run code on a user’s machine. The flaw is tracked as CVE-2026-121529, was reported by Kevin Joensen of Baldur Security (nicknamed “Fortinet2Shell”), and Fortinet rates it Critical with a CVSS v3 score of 9.1. The vulnerability affects FortiClient Mac and FortiClient Windows (including Windows PAM) in the 7.4 and 7.2 branches (specific vulnerable ranges below); FortiClient 8.0 and FortiClient Mac 7.2 are not affected. Fortinet says exploitation requires user interaction (victim visiting a malicious web page) and is not known to be exploited in the wild. (gbhackers.com)
Technical Details
The advisory describes an origin validation/CORS misconfiguration in a local API endpoint run by FortiClient: a web page can send requests to that local service and trigger arbitrary code execution. The vendor lists the issue as unauthenticated with changed scope and escalation of privilege; the CVSS vector indicates network attack, low complexity, no privileges required, user interaction required and changed scope. Joensen reports the issue is particularly reliable when FortiPAM is enabled. Hunting indicators on Windows include a service listening on TCP port 9191 and a running FortiVRS.exe process. (gbhackers.com)
Fix Details
Fortinet states there is no virtual patch; updating is the only mitigation. Upgrade FortiClient Mac and FortiClient Windows 7.4 to 7.4.8 or later, and FortiClient Windows 7.2 (and Windows PAM builds) to 7.2.15 or later. Version 8.0 and FortiClient Mac 7.2 are not affected. (gbhackers.com)
Remediation
Prioritize patching hosts running affected FortiClient 7.4.0–7.4.7 and 7.2.0–7.2.14 (Windows/PAM) to the fixed releases. While patching, hunt for the FortiClient Windows indicators (service on TCP port 9191 and FortiVRS.exe) and prioritize those systems. Advise users to avoid untrusted links and web pages until agents are updated. (gbhackers.com)