Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled

Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website.

The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published the advisory on November 10, 2026.

The flaw is an origin validation error, listed as CWE-346. Researcher Kevin Joensen of Baldur Security found it during internal research and jokingly called it “Fortinet2Shell.” He explained that the root cause is a CORS misconfiguration.

CORS is a browser rule that decides which websites may talk to other services. Here, the setting is too loose. A web page controlled by an attacker can send requests to a local service running on the victim’s machine. The service then runs code the attacker supplies.

Fortinet lists the issue under the API component and rates it as unauthenticated, so the attacker needs no login. The CVSS vector shows that the victim must take one step, such as opening a booby-trapped page. That is why the score is 9.1 and not higher.

Critical Fortinet2Shell Vulnerability

Joensen confirmed reliable code execution, with the flaw affecting FortiClient Mac, Windows, and Windows PAM, while the 8.0 branch and FortiClient Mac 7.2 remain unaffected.

The affected builds are:

• FortiClient Mac 7.4.0 through 7.4.7
• FortiClient Windows 7.4.0 through 7.4.7
• FortiClient Windows 7.2.0 through 7.2.14
• FortiClient Windows PAM 7.4.0 through 7.4.7
• FortiClient Windows PAM 7.2.0 through 7.2.14

The fix is to upgrade to 7.4.8 or later on the 7.4 branch. On the 7.2 branch, upgrade to 7.2.15 or later. Fortinet says no virtual patch exists, so updating the software is the only real fix.

Joensen says checking the version is the first step. On Windows, two more signs may point to a vulnerable setup. One is a service listening on TCP port 9191.

The other is a running FortiVRS.exe process. Admins can look for both across their fleet. These signs only suggest exposure. They do not show that anyone has attacked the machine.

Fortinet marks the flaw as not known to be exploited. Still, the technical details are now public, and the attack path is simple. Web-based flaws like this are easy to copy once people understand the weak spot. Teams should not wait.

FortiClient is widely used for VPN access and endpoint protection, so many staff laptops run it. FortiPAM is Fortinet’s tool for managing privileged accounts. A bug that lets a website reach code running on a machine with that access could give an attacker a strong first foothold.

Fortinet products have been a frequent target this year. Cyber Security News has covered the critical FortiClient EMS flaw that was exploited in the wild and a public exploit for a FortiSIEM bug. Those cases show how fast attackers move once a fix ships.

Update all FortiClient installations to patched versions, prioritize systems running on port 9191 or containing FortiVRS.exe, warn users against unknown links, and review web filtering rules during patch deployment, as detailed in Fortinet’s advisory, the NVD CVSS calculator, and Joensen’s LinkedIn post.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled appeared first on Cyber Security News.