{"id":"EM-20261111-KDF4","url":"https://cyber.eventmonitor.net/incident/EM-20261111-KDF4/critical-fortinet-forticlientmac-vulnerability-cve-2026-121529/","type":"cve","title":"Critical Fortinet FortiClientMac Vulnerability (CVE-2026-121529)","subtitle":"CVE-2026-121529","subject":"CVE-2026-121529","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-11T13:21:13.000Z","firstSignal":"2026-11-10T20:18:56.790Z","lastSignal":"2026-11-11T14:51:45.000Z","updated":"2026-11-11T15:44:07.320Z","revision":2,"life":[{"status":"Born","at":"2026-11-11T13:21:13.000Z","why":"second independent source: C171 GBHackers"},{"status":"Developing","at":"2026-11-11T13:21:13.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T20:18:56.790Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-11T13:21:13.000Z","what":"Born: second source, C171 GBHackers. Page EM-20261111-KDF4 created."},{"at":"2026-11-11T14:51:45.000Z","what":"Source joined: C31 Vulners (new public exploits)"}],"stages":[{"name":"Disclosed","at":"2026-11-10T20:18:56.790Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T20:18:56.790Z","detail":"CVSS 9.6"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T20:18:56.790Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-121529 (CVSS 9.6)","text":"A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121529"},{"at":"2026-11-11T13:21:13.000Z","source":"C171","sourceName":"GBHackers","role":"Research & News","severity":2,"title":"Fortinet2Shell Vulnerability Lets Hackers Execute Code on FortiClient Systems Through Malicious Websites","text":"Fortinet has patched a critical flaw in FortiClient that lets attackers run code on a victim's computer through a malicious website. The bug is tracked as CVE-2026-121529 (advisory FG-IR-26-194). Researcher Kevin Joensen of Baldur Security reported it and nicknamed it \"Fortinet2Shell.\" Attackers have targeted Fortinet endpoint tools before, as seen in a FortiClient code execution [ ] The post…","url":"https://gbhackers.com/fortinet2shell-vulnerability/"},{"at":"2026-11-11T14:51:45.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-121529","text":"# CVE-2026-121529 — FortiClient local API origin validation error (drive-by RCE)\n\n| | |\n|---|---|\n| **CVE** | CVE-2026-121529 |\n| **Component** | FortiClient / FortiClient Windows PAM / FortiClient Mac — local API endpoint (`127.0.0.1:9191`) |\n| **Affected** | Windows & Windows PAM…","url":"https://github.com/googlesky/CVE-2026-121529"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T20:18:56.790","score":9.6,"severity":"CRITICAL","desc":"A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code…","product":"","seen":1794353084878},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}