A critical vulnerability identified as CVE-2026-121529 has been disclosed in FortiClient, affecting both Windows and Mac versions 7.2 and 7.4. The vulnerability enables attackers to execute arbitrary code on systems through malicious websites.
The flaw arises from an origin validation error in the local API, which is due to a CORS misconfiguration. This misconfiguration allows an attacker-controlled site to send requests to the local service, which mistakenly trusts these requests.
The vulnerability has been assigned a CVSS score of 9.1, indicating a high severity level. Successful exploitation requires user interaction, specifically the victim visiting a malicious webpage.
Fortinet has addressed this issue by releasing a patch on November 10, 2026. Users are urged to update to FortiClient versions 7.4.8 or 7.2.15 to mitigate the risk.
Currently, there are no reports of this vulnerability being exploited in the wild. Fortinet advises users to apply the patch promptly to protect their systems.