Origin validation error in Fortinet FortiClient for Windows and FortiClient (macOS) - CVE-2026-121529
Published: November 11, 2026
Vulnerability identifier: #VU165151
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-121529
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to origin validation error in local API endpoint. An unauthorized remote attacker can execute unauthorized code or commands. Successful exploitation requires interaction with the victim.
Affected software
Fortinet FortiClient for Windows
FortiClient (macOS)
FortiClient (macOS)
How to mitigate CVE-2026-121529
Install update from vendor's website.
Fortinet FortiClient for Windows - addressed in versions 7.2.15, 7.4.8
FortiClient (macOS) - update to 7.4.8
FortiClient (macOS) - update to 7.4.8