{"api_version":"1","generated_at":"2026-11-13T08:39:12+00:00","cve":"CVE-2026-121529","urls":{"html":"https://cve.report/CVE-2026-121529","api":"https://cve.report/api/cve/CVE-2026-121529.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-121529","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-121529"},"summary":{"title":"CVE-2026-121529","description":"A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.","state":"PUBLISHED","assigner":"fortinet","published_at":"2026-11-10 20:18:56","updated_at":"2026-11-13 05:18:13"},"problem_types":["CWE-346","CWE-346 Escalation of privilege"],"metrics":[{"version":"3.1","source":"psirt@fortinet.com","type":"Secondary","score":"9.6","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C","version":"3.1"}}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-194","name":"https://fortiguard.fortinet.com/psirt/FG-IR-26-194","refsource":"psirt@fortinet.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121529","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121529","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Fortinet","product":"FortiClientMac","version":"affected 7.4.0 7.4.7 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiClientWindows","version":"affected 7.4.0 7.4.7 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiClientWindows","version":"affected 7.2.0 7.2.14 semver","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiClientWindowsPAM","version":"affected 7.4.7","platforms":[]},{"source":"CNA","vendor":"Fortinet","product":"FortiClientWindowsPAM","version":"affected 7.2.14","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to FortiClientWindowsPAM version 8.0.0 or above\nUpgrade to FortiClientWindowsPAM version 7.4.8 or above\nUpgrade to FortiClientWindowsPAM version 7.2.15 or above\nUpgrade to FortiClientWindows version 8.0.0 or above\nUpgrade to FortiClientWindows version 7.4.8 or above\nUpgrade to FortiClientWindows version 7.2.15 or above\nUpgrade to FortiClientMac version 8.0.0 or above\nUpgrade to FortiClientMac version 7.4.8 or above","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"121529","cve":"CVE-2026-121529","epss":"0.002180000","percentile":"0.123940000","score_date":"2026-11-12","updated_at":"2026-11-13 00:14:36"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-121529","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-13T05:00:09.725Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:fortinet:forticlientmac:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientMac","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:forticlientwindows:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientWindows","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.14","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:forticlientwindowspam:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindowspam:7.2.14:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientWindowsPAM","vendor":"Fortinet","versions":[{"status":"affected","version":"7.4.7"},{"status":"affected","version":"7.2.14"}]}],"descriptions":[{"lang":"en","value":"A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-346","description":"Escalation of privilege","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T00:04:36.559Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","shortName":"fortinet"},"references":[{"name":"https://fortiguard.fortinet.com/psirt/FG-IR-26-194","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-194"}],"solutions":[{"lang":"en","value":"Upgrade to FortiClientWindowsPAM version 8.0.0 or above\nUpgrade to FortiClientWindowsPAM version 7.4.8 or above\nUpgrade to FortiClientWindowsPAM version 7.2.15 or above\nUpgrade to FortiClientWindows version 8.0.0 or above\nUpgrade to FortiClientWindows version 7.4.8 or above\nUpgrade to FortiClientWindows version 7.2.15 or above\nUpgrade to FortiClientMac version 8.0.0 or above\nUpgrade to FortiClientMac version 7.4.8 or above"}]}},"cveMetadata":{"assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","assignerShortName":"fortinet","cveId":"CVE-2026-121529","datePublished":"2026-11-10T20:10:36.385Z","dateReserved":"2026-11-03T14:32:11.672Z","dateUpdated":"2026-11-13T05:00:09.725Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 20:18:56","lastModifiedDate":"2026-11-13 05:18:13","problem_types":["CWE-346","CWE-346 Escalation of privilege"],"metrics":{"cvssMetricV31":[{"source":"psirt@fortinet.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-12T00:00:00+00:00","id":"CVE-2026-121529","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"121529","Ordinal":"1","Title":"CVE-2026-121529","CVE":"CVE-2026-121529","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"121529","Ordinal":"1","NoteData":"A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.","Type":"Description","Title":"CVE-2026-121529"}]}}}