Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled

What happened?

Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published the advisory on November 10, 2026. The flaw is an origin validation error, listed as CWE-346. Researcher Kevin Joensen of Baldur Security found it during internal research and jokingly called it “Fortinet2Shell.” He explained that the root cause is a CORS misconfiguration.

Key details

• The vulnerability is tracked as CVE-2026-121529 with a CVSS score of 9.1 and was published by Fortinet on November 10, 2026.
• Researcher Kevin Joensen of Baldur Security discovered the flaw during internal research and named it Fortinet2Shell.
• The flaw is unauthenticated and rated under the API component; the victim must take one action such as opening a booby-trapped page.
• Fortinet states the vulnerability is not known to be exploited, but technical details are public and the attack path is simple.
• FortiClient is widely used for VPN and endpoint protection, and FortiPAM manages privileged accounts, so a successful attack could give a strong initial foothold.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.