Critical Fortinet2Shell Vulnerability Allows RCE via Malicious Websites
A critical Cross-Origin Resource Sharing (CORS) misconfiguration in FortiClient, dubbed 'Fortinet2Shell', allows unauthenticated remote attackers to execute arbitrary code on user systems by tricking them into visiting a malicious website.
Fortinet has issued a warning regarding a critical vulnerability, CVE-2026-121529, affecting its FortiClient software on Windows and macOS. This flaw, which carries a CVSS score of 9.1, enables unauthenticated remote attackers to achieve arbitrary code execution on a victim's machine simply by luring them to a specially crafted malicious website.
The vulnerability, discovered by Kevin Joensen of Baldur Security and humorously named 'Fortinet2Shell', stems from an overly permissive Cross-Origin Resource Sharing (CORS) configuration. CORS is a security mechanism that governs how web pages from one origin can interact with resources from another. In this instance, the misconfiguration allows a malicious webpage to send requests to local services running on the user's machine, which then execute attacker-supplied code.
Fortinet has categorized the vulnerability under its API component and noted that it is unauthenticated, meaning an attacker does not need any prior access or credentials to exploit it. The CVSS vector indicates that a user must perform a single action, such as visiting a compromised webpage, to trigger the exploit, contributing to its high severity score.
The affected versions include FortiClient Mac 7.4.0 through 7.4.7, FortiClient Windows 7.4.0 through 7.4.7, FortiClient Windows 7.2.0 through 7.2.14, and FortiClient Windows PAM 7.2.0 through 7.2.14. Fortinet strongly advises users to upgrade to FortiClient versions 7.4.8 or later for the 7.4 branch, and 7.2.15 or later for the 7.2 branch. The vendor has stated that no virtual patching is available, making immediate software updates the only effective mitigation.
Joensen provided indicators that administrators can look for to identify potentially vulnerable systems. On Windows, these include a service listening on TCP port 9191 and the presence of a running FortiVRS.exe process. While these signs suggest potential exposure, they do not confirm an active compromise. Fortinet has not reported any known exploitation in the wild, but the public disclosure of the vulnerability and its straightforward attack vector increase the risk of copycat attacks.
Given FortiClient's widespread use for VPN access and endpoint security, the potential impact of this vulnerability is significant. The inclusion of FortiPAM, Fortinet's privileged access management solution, in the affected products further elevates the risk, as a successful exploit could grant attackers a powerful foothold within an organization's network.
This incident follows a series of other vulnerabilities discovered in Fortinet products this year, including a critical flaw in FortiClient EMS that was actively exploited and a publicly available exploit for a FortiSIEM bug. These past events highlight the speed at which threat actors can weaponize newly disclosed vulnerabilities once patches are released.
Organizations are urged to prioritize patching affected FortiClient installations, particularly those exhibiting the identified indicators. Additionally, users should remain vigilant against suspicious links, and security teams should review web filtering rules as part of their patch deployment strategy. Integrating threat intelligence can further assist Security Operations Centers (SOCs) in detecting and responding to potential incidents.