A critical vulnerability has been discovered in FortiClient, Fortinet's VPN and security client. Tracked as CVE-2026-121529 (CVSS score: 9.1), this vulnerability could allow a remote attacker to execute code on a user's workstation simply by tricking them into visiting a malicious webpage, without requiring any authentication.

Affected Versions:

• FortiClient for Windows and macOS versions 7.4.0 through 7.4.7.

• FortiClient for Windows versions 7.2.0 through 7.2.14, including PAM versions.

Recommendations:

• Upgrade to version 7.4.8 or 7.2.15, or later.

• Avoid clicking on unknown links received via email or messaging platforms.

• Report any suspicious activity or security incident to CIRT.CM.