A Malicious Web Page Can Reach FortiClient’s Local API
Fortinet has disclosed a critical origin-validation flaw in FortiClient for Windows and Mac. A remote attacker can use crafted content to reach the client’s local API and potentially run commands on the endpoint. The attack requires the victim to interact with that content. The patch belongs on the affected endpoint software, including systems that rarely connect to the corporate VPN. CVE-2026-121529 · Fortinet advisory
Check the endpoint package
Fortinet identifies affected FortiClient builds in the 7.4 series on Mac and in the 7.4 and 7.2 series on Windows. Its upgrade guidance lists 7.4.8 or later for affected 7.4 installations, 7.2.15 or later for the affected Windows 7.2 line, and 8.0.0 or later as an upgrade route. Windows PAM editions also have fixes. Match the installed edition to the advisory and verify the running client after deployment. An update to the firewall or the central management console does not establish that each endpoint has the fixed local client. Fortinet’s CVE record and upgrade guidance
Update, 12 November 2026
Latvia’s CERT advised applying the fixes promptly in its 11 November bulletin, which lists Windows PAM exposure across 7.4.0 through 7.4.7 and 7.2.0 through 7.2.14. Fortinet’s CVE record as of 12 November names only the end builds for those two PAM lines. Until the version ranges are clarified, check any PAM installation in the broader ranges against the product advisory and verify the fixed build. CERT.LV alert · Fortinet’s CVE record
