Skip to navigation

Threat reportVulnerabilityTL-2026-5802

Fortinet2Shell: FortiClient Local API Origin Validation Flaw Enables Code Execution via Malicious Websites (CVE-2026-121529)

criticalPATCHED

CVE-2026-121529 (Fortinet advisory FG-IR-26-194, CWE-346) is an origin validation error in a FortiClient local API endpoint that lets a malicious web page drive a local FortiClient service and execute code or commands on the victim's machine. Fortinet rates it Critical (CVSS 9.1), requires user interaction, and states it is not known to be exploited; fixes are in FortiClient 7.4.8 and 7.2.15.

Key facts

IdentifiersTL-2026-5802, CVE-2026-121529, CVE-2026-35616
Also known asFortinet2Shell, FG-IR-26-194
SeverityCRITICAL
CVSS9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C)
First disclosed
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2026-35616 (added )
EPSSCVE-2026-35616: 9.0% (95.1th percentile)
Affected productsFortinet FortiClient Mac; Fortinet FortiClient Windows; Fortinet FortiClient Windows PAM
Weaknesses (CWE)CWE-346
ToolsFortiClient Mac, FortiClient Windows, FortiClient Windows PAM
MITRE ATT&CK techniquesT1059 Command and Scripting Interpreter, T1203 Exploitation for Client Execution, T1204.001 User Execution: Malicious Link
MotivationUNKNOWN
Target sectorstechnology, enterprise, government administration, finance
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5802 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FortiClient Service Spawning Shell or Script Interpreter (CVE-2026-121529 Fortinet2Shell Exploitation)

Detects cmd, PowerShell, script hosts or LOLBin interpreters launched by a FortiClient service process (FortiClient.exe, FortiVRS.exe, FortiESNAC.exe and related). CVE-2026-121529 (FG-IR-26-194, CWE-346) lets a malicious web page drive the FortiClient local API (TCP 9191) into running code or commands, so a FortiClient parent spawning an interpreter is the observable outcome of successful exploitation. Fortinet states no in-the-wild exploitation is known; this rule is behaviour-first, not signature based.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1203, T1059, T1059.001, T1059.003
  • Data sources: sysmon, DeviceProcessEvents, windows_process_creation
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage IN ("*FortiClient.exe", "*FortiVRS.exe", "*FortiESNAC.exe", "*FCDBLog.exe", "*FortiSettings.exe", "*FortiTray.exe") Image IN ("*cmd.exe", "*powershell.exe", "*pwsh.exe", "*wscript.exe", "*cscript.exe", "*mshta.exe", "*rundll32.exe", "*regsvr32.exe")
```Any interpreter child of a FortiClient service process is anomalous; review CommandLine and User```
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users values(IntegrityLevel) as integrity_levels by host ParentImage ParentCommandLine Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let FortiParents = dynamic(["FortiClient.exe", "FortiVRS.exe", "FortiESNAC.exe", "FCDBLog.exe", "FortiSettings.exe", "FortiTray.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (FortiParents)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel
| order by Timestamp desc

Sigma

title: FortiClient Service Spawning Shell or Script Interpreter
id: 7a1c3e52-9d4b-4f60-8a21-5e0b7c9d1f01
status: experimental
description: Detects an interpreter or script host spawned by a FortiClient service process, the observable result of CVE-2026-121529 (FG-IR-26-194) local API origin validation abuse via a malicious web page.
references:
    - https://fortiguard.fortinet.com/psirt/FG-IR-26-194
    - https://nvd.nist.gov/vuln/detail/CVE-2026-121529
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.execution
    - attack.t1203
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026.121529
logsource:
    category: process_creation
    product: windows
detection:
    sel_parent:
        ParentImage|endswith: ['\FortiClient.exe', '\FortiVRS.exe', '\FortiESNAC.exe', '\FCDBLog.exe', '\FortiSettings.exe', '\FortiTray.exe']
    sel_child:
        Image|endswith: ['\cmd.exe', '\powershell.exe', '\pwsh.exe', '\wscript.exe', '\cscript.exe', '\mshta.exe', '\rundll32.exe', '\regsvr32.exe']
    condition: sel_parent and sel_child
falsepositives:
    - FortiClient installer, upgrade or EMS remediation scripts that legitimately launch cmd or PowerShell
    - Administrator-deployed FortiClient post-connect scripts
level: high

Known false positives:

  • FortiClient upgrade or EMS remediation workflows that legitimately invoke cmd.exe or PowerShell
  • Customer-defined FortiClient VPN connect or disconnect scripts

Tuning notes: Baseline 14 days of FortiClient-parented interpreter launches and exclude known ParentCommandLine plus CommandLine pairs from your deployment tooling. The exact vulnerable service binary is not published (FortiVRS.exe is the researcher-reported process), so confirm the binary names against your install. FortiClient Mac 7.4.x is also affected: mirror this logic with macOS process telemetry for FortiClient parenting sh, bash, zsh or osascript.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Browser Connecting to FortiClient Local API on Loopback TCP 9191 (Fortinet2Shell Drive-by Trigger) · unlock with TL Creds
  • FortiClient Process Dropping Executable or Script Into User-Writable Path · unlock with TL Creds
  • Lateral Movement Tooling Spawned by FortiClient Process · unlock with TL Creds
  • Vulnerable FortiClient Exposure Indicator: [indicator] Running (CVE-2026-121529) · unlock with TL Creds
  • FortiClient Parent Spawning Privilege or Persistence Commands · unlock with TL Creds
  • FortiClient Parent Spawning Download Cradle or Encoded Command (Ingress Tool Transfer) · unlock with TL Creds
  • FortiClient-Spawned Interpreter Running as SYSTEM or High Integrity (CVE-2026-121529 Privilege Escalation Impact) · unlock with TL Creds
  • FortiClient Process Outbound Connection to Non-Fortinet Public Destination (Possible C2 After CVE-2026-121529) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5802.

10 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Fortinet published advisory FG-IR-26-194 on 2026-11-10 for an origin validation error (CWE-346) in the local API component of FortiClient Mac, FortiClient Windows and FortiClient Windows PAM. Per the advisory, an unauthenticated remote attacker may execute unauthorized code or commands, and exploitation requires victim interaction. Fortinet lists the impact as escalation of privilege. The issue was reported externally by Kevin Joensen of Baldur Security under responsible disclosure, and the press coverage nicknamed it 'Fortinet2Shell'.

According to GBHackers' reporting, the root cause is a CORS misconfiguration: FortiClient runs a local service that wrongly trusts requests originating from web pages. When a victim visits an attacker-controlled page, script in that page sends cross-origin requests to the local FortiClient service, which accepts them and can be driven to run code on the host. The researcher reportedly states the exploit works reliably when FortiPAM is enabled. Note that this mechanism description comes from the press article; the Fortinet advisory itself only states the CWE-346 origin validation error and the code-execution impact.

Scoring: Fortinet's advisory lists CVSS v3 9.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (the E:P/RL:O/RC:C temporal metrics are included). The NVD record (published 2026-11-10, status Received) carries Fortinet's CVSS 3.1 base vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H with base score 9.6, and a CISA SSVC assessment of Exploitation: none, Automatable: no, Technical Impact: total.

Affected: FortiClient Mac 7.4.0-7.4.7; FortiClient Windows 7.4.0-7.4.7 and 7.2.0-7.2.14; FortiClient Windows PAM 7.4.0-7.4.7 and 7.2.0-7.2.14. Not affected: version 8.0 of all three products and FortiClient Mac 7.2. Fixed in 7.4.8 and 7.2.15. Fortinet lists no workarounds and no virtual patch, so upgrading is the only remediation.

Exploitation status: Fortinet states the flaw is not known to be exploited, no public PoC or threat actor is named in the sources, and CISA SSVC lists exploitation as none. Researcher-reported Windows hunting indicators are a service listening on TCP port 9191 and a running FortiVRS.exe process; these identify exposed hosts rather than compromise. No file hashes, domains or IP addresses are published. Scoring caveat: the advisory lists 9.1 alongside a vector whose temporal metrics compute to roughly 8.6 and whose base metrics compute to 9.6 (NVD), so the score and vector are not mutually consistent; 9.1 is recorded as Fortinet's published figure. Separately, FortiClient EMS (a different product, CVE-2026-35616) was exploited in 2026 to deploy the EKZ infostealer; that is a distinct issue and is listed only as related context.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Remediation

Patches

  • FortiClient Mac 7.4.8+
  • FortiClient Windows 7.4.8+ / 7.2.15+
  • FortiClient Windows PAM 7.4.8+ / 7.2.15+

Immediate actions

  • Upgrade FortiClient Windows, Windows PAM and Mac 7.4.x to 7.4.8 or later
  • Upgrade FortiClient Windows and Windows PAM 7.2.x to 7.2.15 or later
  • Hunt the fleet for hosts with a service listening on TCP 9191 and a running FortiVRS.exe process and patch those first
  • Advise users to avoid untrusted links until patching completes

Workarounds

  • None listed by Fortinet; no virtual patch available. FortiClient 8.0 and FortiClient Mac 7.2 are not affected.

Longer-term hardening

  • Keep all endpoint agents on current releases
  • Inventory FortiClient deployments, including FortiPAM-enabled endpoints
  • Monitor endpoint and browser telemetry for web-originated requests to local agent services

Affected and fixed versions

  • Fortinet — FortiClient Mac
    Vulnerable versions: 7.4.0 through 7.4.7
    Fixed in: 7.4.8 or above
  • Fortinet — FortiClient Windows
    Vulnerable versions: 7.4.0 through 7.4.7; 7.2.0 through 7.2.14
    Fixed in: 7.4.8 or above; 7.2.15 or above
  • Fortinet — FortiClient Windows PAM
    Vulnerable versions: 7.4.0 through 7.4.7; 7.2.0 through 7.2.14
    Fixed in: 7.4.8 or above; 7.2.15 or above

Timeline

  • Context only (different flaw): GBHackers, citing Arctic Wolf Labs, reports FortiClient EMS CVE-2026-35616 exploited to push the EKZ infostealer; GBHackers later cites this as an earlier FortiClient code-execution flaw. Not part of CVE-2026-121529.
  • Fixed builds FortiClient 7.4.8 (Mac, Windows, Windows PAM) and 7.2.15 (Windows, Windows PAM) are listed as the remediation; 8.0 of all three products and FortiClient Mac 7.2 are listed as not affected.
  • Fortinet advisory states the flaw is not known to be exploited and that no virtual patch or workaround exists; upgrading is the only remediation.
  • CISA SSVC assessment recorded in NVD: Exploitation none, Automatable no, Technical Impact total.
  • NVD publishes CVE-2026-121529 (status Received) with Fortinet CVSS 3.1 base score 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and CWE-346.
  • Fortinet publishes PSIRT advisory FG-IR-26-194 for CVE-2026-121529, an origin validation error (CWE-346) in the FortiClient local API; fixed versions 7.4.8 and 7.2.15 released; credited to Kevin Joensen of Baldur Security.
  • GBHackers publishes 'Fortinet2Shell', describing the CORS misconfiguration in the FortiClient local service and Windows hunting indicators (TCP 9191, locked-ioc-1).

Sources cited

Other reports on CVE-2026-35616

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats