Threat video1:00
CVE-2026-121529 FortiClient API RCE: Detection & IOCs
Malicious web pages can drive a local FortiClient API to run code. Fixed in 7.4.8 and 7.2.15; 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-121529 FortiClient API RCE: Detection & IOCs →
Chapters
- 0:00The hookMalicious pages run code on FortiClient.
- 0:04The storyFortinet shipped fixes on November 10.
- 0:11Attack pathAccording to GBHackers, a web page reaches FortiClient.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise3 indicators to hunt: 1 file name and 2 package names.
- 0:37MITRE ATT&CK techniques3 ATT&CK techniques, in execution.
- 0:42Remediation4 steps now: Upgrade FortiClient Windows, Windows PAM and Mac 7.4.x.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Malicious pages run code on FortiClient.
0:05Fortinet shipped fixes on November 10.
0:07Upgrade. No workaround.
0:11According to GBHackers, a web page reaches FortiClient.
0:15Cross-origin requests reach a local service.
0:18Code then runs on the host.
0:20Impact: privilege escalation.
0:26No threat actor is attributed. Confidence: low.
0:313 indicators to hunt: 1 file name and 2 package names.
0:373 ATT&CK techniques, in execution.
0:424 steps now: Upgrade FortiClient Windows, Windows PAM and Mac 7.4.x.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.