🚨 Critical Fortinet2Shell flaw lets malicious websites execute code on FortiClient devices, CVE-2026-121529
Fortinet has patched a critical vulnerability in FortiClient that could allow attackers to execute malicious code on a victim's computer simply by getting them to visit a malicious website.
Dubbed Fortinet2Shell, the flaw carries a CVSS score of 9.1 and stems from improper security restrictions in a local API service.
Researchers demonstrated how attackers could exploit the weakness on systems with FortiPAM enabled, potentially compromising affected endpoints without authentication.
The vulnerability affects FortiClient 7.4.0 through 7.4.7 on Windows and macOS, along with Windows versions 7.2.0 through 7.2.14. Fortinet has released patched versions 7.4.8 and 7.2.15, with no confirmed exploitation in the wild.