FortiClient Vulnerability Fortinet2Shell (CVE-2026-121529): A Malicious Website Could Run Code on Windows and Mac Laptops, and the Fixed Versions to Install

Fortinet has fixed a critical flaw in FortiClient, its VPN and endpoint software for Windows and Mac. An affected version could let a malicious website run code on the computer it is installed on. If your staff connect to the office through FortiClient, check the version on every laptop this week: Fortinet lists no workaround, so updating is the only fix.

The flaw is tracked as CVE-2026-121529, under Fortinet advisory FG-IR-26-194. The researcher who reported it calls it Fortinet2Shell. Fortinet published the advisory on Tuesday, November 10, 2026, in a monthly release that SecurityWeek counted at 89 advisories covering nearly 100 vulnerabilities.

What Fortinet has confirmed about CVE-2026-121529

These points come straight from Fortinet's advisory:

• What it is: an origin validation error (CWE-346) in a local API endpoint, meaning a program on the computer accepts requests without properly checking where they come from.
• Severity: Critical, with a CVSS v3 score of 9.1.
• Impact: an unauthorized remote attacker may be able to execute unauthorized code or commands. Fortinet lists the impact as escalation of privilege and the attack type as unauthenticated.
• The catch: Fortinet says successful exploitation requires interaction with the victim.
• Workaround: none listed, and no virtual patch.
• Exploitation: Fortinet marks it as not known to be exploited.
• Credit: Kevin Joensen of Baldur Security, through responsible disclosure.

FortiClient versions affected and fixed

If your laptops run 7.2 or 7.4, the fix is to move to the patched build on the same branch. Moving to 8.0 is a bigger change, so test it before rolling it out.

What is claimed but not confirmed

Most of the detail in the news coverage comes from the researcher's own posts, as reported by SecurityWeek and GBHackers. Fortinet's advisory does not say it.

• How the attack works: the researcher reportedly describes the root cause as a CORS misconfiguration. In plain terms, your browser normally stops a website from talking to programs running on your own computer unless those programs allow it. If a local FortiClient service accepts requests from any website, a page you browse to can send it commands. Fortinet's "origin validation error" label fits that description, but Fortinet does not use the word CORS or give a technical walkthrough.
• Whether FortiPAM must be turned on: SecurityWeek reports the researcher saying the bug can only be exploited when FortiPAM is enabled. FortiPAM is Fortinet's privileged access management product, which IT staff use to reach servers and admin accounts. Fortinet's advisory, though, lists the standard FortiClient Windows and Mac builds as affected without any such condition. Until Fortinet says otherwise, treat every version in the table as vulnerable.
• What is not known: we could not find a full technical write-up or public exploit code from the researcher. It is also unclear what victim interaction is needed beyond visiting a page. Fortinet says only that interaction is required.

Why this FortiClient flaw matters for a company network

FortiClient lives on the laptops that connect to your company network, often from home, a hotel or a client site. Your office firewall does not sit between those laptops and the websites people visit. A browser tab is all the attack reportedly needs.

The PAM angle makes it worse. FortiClient Windows PAM is on the affected list. The machines most likely to run it belong to the people with the keys to your servers: your IT staff, your managed service provider, your admins. Code running on one of those laptops is a step toward everything they can reach.

This kind of software is also easy to miss. Firewalls and servers get attention on patch day. A VPN client spread across thirty laptops, some of them rarely online, often sits on whatever version it was installed with.

What to do this week

1. Find every FortiClient install. If you manage endpoints with FortiClient EMS, use its endpoint list. If not, check your device management tool or ask staff directly.
2. Check the version. On Windows, look under Settings, Apps, Installed apps, or open FortiClient's About screen. On a Mac, select FortiClient in the Applications folder and use Get Info.
3. Update to the fixed build: 7.4.8 or above on the 7.4 branch, 7.2.15 or above on the 7.2 branch (Windows and Windows PAM).
4. Do IT and admin machines first, especially any with FortiClient Windows PAM or FortiPAM in use.
5. Chase the stragglers. Note laptops that are offline or out of the office and confirm they update when they next connect.
6. Until a machine is patched, keep its browsing to work sites only, and have staff avoid opening links from unknown senders.
7. Watch your endpoint protection for unusual programs launched on machines that were running an affected version.

FortiClient vulnerability questions people are asking

What is Fortinet2Shell?

It is the researcher's name for CVE-2026-121529, a critical FortiClient flaw that Fortinet patched on November 10, 2026. It could let a malicious website run code on a computer with an affected FortiClient version.

Is CVE-2026-121529 being exploited?

Fortinet's advisory marks it as not known to be exploited. That can change, so patch now rather than waiting for reports of attacks.

Which FortiClient version fixes CVE-2026-121529?

FortiClient 7.4.8 or above for Windows, Mac and Windows PAM on the 7.4 branch. FortiClient 7.2.15 or above for Windows and Windows PAM on the 7.2 branch.

Is FortiClient 8.0 affected?

No. Fortinet lists FortiClient 8.0 for Windows, Mac and Windows PAM as not affected.

Is the free FortiClient VPN affected?

Fortinet says FortiClient Windows Free VPN is not impacted.

Do I need FortiPAM enabled to be vulnerable?

The researcher reportedly says yes. Fortinet's advisory does not mention that condition and lists standard Windows and Mac builds as affected, so update either way.

Is there a workaround for the FortiClient RCE?

No. Fortinet lists no workaround and no virtual patch, so updating is the only fix.

The bigger lesson

The software your staff use to reach the network is part of your network's security, even when it runs on a laptop at someone's kitchen table. A VPN client that answers requests from websites is an open door, and it needs the same patch schedule as the firewall it connects to. Know where it is installed, know its version, and have someone responsible for keeping it current.

For help hardening your endpoints and remote access, see security hardening or get a quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Fortinet PSIRT advisory FG-IR-26-194; SecurityWeek; GBHackers.