SB2026111123 - Origin validation error in FortiClient (macOS) and Fortinet FortiClient for Windows
Published: November 11, 2026
Security Bulletin ID
SB2026111123
CSH Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Origin validation error (CVE-ID: CVE-2026-121529)
CWE-ID: CWE-346 - Origin Validation Error
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to origin validation error in local API endpoint. An unauthorized remote attacker can execute unauthorized code or commands. Successful exploitation requires interaction with the victim.
Remediation
Install update from vendor's website.