If your inventory just says “FortiClient,” check the platform, edition and version before opening a patch ticket. Fortinet’s November 13 guidance identifies which agents need an update.
CVE-2026-121529 / FG-IR-26-194 · Vendor publication November 10, 2026 · Applicability clarification November 13, 2026 · Last verified November 14, 2026 UTC.
Which installations need a patch
Fortinet’s November 13 staff guidance says FortiClient EMS and the Windows Free VPN agent are unaffected. The PSIRT bulletin also lists FortiClient Free VPN and the Standalone Mobility Agent as unaffected. The Windows, macOS and Windows PAM 8.0 branches and macOS 7.2 are unaffected.
| Product branch | Affected versions | Fixed version |
|---|---|---|
| FortiClient Windows and Windows PAM 7.4 | 7.4.0–7.4.7 | 7.4.8 or later |
| FortiClient Windows and Windows PAM 7.2 | 7.2.0–7.2.14 | 7.2.15 or later |
| FortiClient macOS 7.4 | 7.4.0–7.4.7 | 7.4.8 or later |
For Windows PAM, the Fortinet-authored CVE record enumerates only 7.4.7 and 7.2.14. Fortinet’s PSIRT matrix, its CSAF file and its support clarification give the full affected ranges shown above. Use those ranges for inventory and patch targeting.
Exploitation and priority
Fortinet rates this Critical and publishes a CVSS v3.1 score of 9.1. An unauthenticated remote attacker could trigger unauthorized code or command execution through insufficient origin validation in a local agent API. Successful exploitation requires user interaction. Fortinet lists no known exploitation. Its CNA vector indicates proof-of-concept maturity. CISA KEV did not list the CVE on November 14.
Suggested MSP priority. Expedite patching confirmed affected agents and start with endpoints used for privileged administration.
Rollout checks
- Inventory. Use FortiClient EMS, Intune or RMM inventory where available. Confirm product edition, platform and installed agent version per customer. Prioritize affected privileged-access endpoints.
- Contain if warranted. If endpoint telemetry indicates compromise, isolate through your incident process and preserve evidence before any rebuild. Fortinet lists no virtual patch, and the advisory provides no workaround or incident-specific credential rotation guidance.
- Patch and verify. Pilot the fixed version for each affected branch, then roll it out. Confirm the installed version and verify VPN, ZTNA or PAM connectivity and policy enforcement as applicable.
Official sources
FortiGuard PSIRT FG-IR-26-194 · Fortinet CSAF · Fortinet’s November 13 applicability clarification · Fortinet-authored CVE record · CISA KEV catalog data