Fortinet has patched a critical vulnerability in FortiClient rated CVSS 9.1. Simply opening an attacker-controlled web page is enough to run code on the user's machine.
On 10 November 2026, Fortinet published security advisory FG-IR-26-194, disclosing a critical flaw in FortiClient, its enterprise endpoint and VPN client. The vulnerability, tracked as CVE-2026-121529, carries a CVSSv3 score of 9.1 in Fortinet's own assessment. Kevin Joensen of Baldur Security, who reported it through responsible disclosure, nicknamed it "Fortinet2Shell".
How the flaw works
The root cause is faulty origin validation in a local service that FortiClient runs in the background. Because of a misconfigured CORS policy, that service can accept requests coming from a web page without checking their origin properly. The practical result is code execution on the user's machine when they open a page the attacker controls. This is not a server-side attack: a single click on a link is enough.
According to Fortinet's advisory, the affected releases are:
- FortiClient Windows and Mac 7.4: versions 7.4.0 through 7.4.7
- FortiClient Windows 7.2: versions 7.2.0 through 7.2.14
- FortiClient Windows PAM 7.4 and 7.2: the same version ranges
The fixed builds are 7.4.8 for the 7.4 branch and 7.2.15 for the 7.2 branch. FortiClient 8.0 releases and FortiClient Mac 7.2 are not affected. As of the advisory date Fortinet reported no evidence of exploitation and listed no workaround, which means upgrading is the only remedy.
Why it matters
Most organisations keep their firewall firmware reasonably current, yet the VPN client sitting on employee laptops rarely gets the same attention. That is exactly where this flaw lands: on the endpoint that connects from a hotel room or a home network, outside the corporate perimeter. An attacker does not need a foothold in your network — the user's browser is the entry point.
FortiClient is the default remote access tool for organisations running FortiGate firewalls, and in Turkey that covers a wide range of mid-sized businesses. Construction site offices, shipping and agency firms, logistics operators and field teams use it daily. Because those same devices reach systems that process personal data, endpoint code execution also touches the technical-measures obligations under Turkey's data protection framework.
In practice the hard part is rarely the patch itself — it is the inventory. Many smaller companies cannot say which FortiClient version is installed on which machine. If you do not know the version, you cannot know whether the fix has landed.
What Kamer Bilişim recommends
- Start with an inventory. If you run FortiClient EMS, pull a version report from the console. Without central management, use your domain tooling or a short inventory script to list the FortiClient version on every laptop and desktop, and group the 7.4.x and 7.2.x machines separately.
- Do not leave the upgrade to users. Push 7.4.8 to the 7.4 branch and 7.2.15 to the 7.2 branch through central deployment. For machines that have been in the field for months without visiting the office, schedule the update over the VPN connection — those devices are usually the furthest behind.
- Remove what you do not use. Disable the PAM module if you have no need for it, and fully uninstall the client from decommissioned machines and the laptops of departed staff. Review endpoint EDR or antivirus logs for unexpected process-spawning events.
If you are not certain which versions are running across your remote access estate, we can carry out an inventory and patch plan on site anywhere on Istanbul's Anatolian side, or remotely. Get in touch through our contact page.
Source: Fortinet PSIRT – advisory FG-IR-26-194 (10 November 2026)
Source: Fortinet PSIRT