Critical Fortinet2Shell Vulnerability
Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published the advisory on November 10, 2026.
The issue is an origin validation error, classified as CWE-346. Researcher Kevin Joensen from Baldur Security discovered it during internal research and humorously dubbed it “Fortinet2Shell.” He noted that the root cause is a CORS misconfiguration.
CORS, which stands for Cross-Origin Resource Sharing, is a security rule browsers use to determine which websites can interact with other services. In this context, the settings are too permissive. As a result, a web page controlled by an attacker can send requests to a local service running on a victim’s machine, causing that service to execute code provided by the attacker.
Fortinet categorizes the issue under the API component and rates it as unauthenticated, meaning that an attacker does not need to log in. According to the CVSS vector, the victim must take a single action, such as opening a compromised page. This is the reason why the score is 9.1 rather than higher.
Critical Fortinet2Shell Vulnerability
Joensen confirmed reliable code execution, with the flaw affecting FortiClient Mac, Windows, and Windows PAM, while the 8.0 branch and FortiClient Mac 7.2 remain unaffected.
The affected builds are:
- FortiClient Mac 7.4.0 through 7.4.7
- FortiClient Windows 7.4.0 through 7.4.7
- FortiClient Windows 7.2.0 through 7.2.14
- FortiClient Windows PAM 7.4.0 through 7.4.7
- FortiClient Windows PAM 7.2.0 through 7.2.14
The fix is to upgrade to 7.4.8 or later on the 7.4 branch. On the 7.2 branch, upgrade to 7.2.15 or later. Fortinet says no virtual patch exists, so updating the software is the only real fix.
Joensen says checking the version is the first step. On Windows, two more signs may point to a vulnerable setup. One is a service listening on TCP port 9191.
The other is a running FortiVRS.exe process. Admins can look for both across their fleet. These signs only suggest exposure. They do not show that anyone has attacked the machine.
Fortinet has indicated that this vulnerability is not currently known to be exploited. However, the technical details are now publicly available, and the method of attack is straightforward. Web-based vulnerabilities like this can be easily replicated once the weak point is understood. Teams should take action without delay.
FortiClient is widely used for VPN access and endpoint protection, so many staff laptops run it. FortiPAM is Fortinet’s tool for managing privileged accounts. A bug that lets a website reach code running on a machine with that access could give an attacker a strong first foothold.
Fortinet products have been a frequent target this year. Cyber Security News has covered the critical FortiClient EMS flaw that was exploited in the wild and a public exploit for a FortiSIEM bug. Those cases show how fast attackers move once a fix ships.
Update all FortiClient installations to patched versions, prioritize systems running on port 9191 or containing FortiVRS.exe, warn users against unknown links, and review web filtering rules during patch deployment, as detailed in Fortinet’s advisory.
