CVE-2026-121529

Summary

A missing origin validation flaw in FortiClient versions 7.2.x and 7.4.x allows remote attackers to bypass expected origin checks during SSL/TLS tunnel establishment, enabling unauthorized code execution when a victim interacts with a malicious endpoint. This is a CWE-346 (Missing Origin Validation) vulnerability affecting both Windows and macOS clients.

Exploitability

Exploitation requires network-level interaction with the victim (e.g.,诱使 them to visit a malicious site or connect to a rogue server), as UI interaction is explicitly required per CVSS vector UI:R, and no public exploit code exists.

Blast radius

Successful exploitation could lead to full system compromise (remote code execution) on affected endpoints, potentially enabling lateral movement, credential theft, or persistent access within the victim's network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade FortiClientWindows to 7.2.15 or later, or 7.4.8 or later; upgrade FortiClientMac to 7.4.8 or later; upgrade FortiClientWindowsPAM to 7.2.15 or 7.4.8 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.