EUVD-2026-29730
GHSA-5f54-54jr-q897
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>
AnalysisAI
Fortinet FortiClient Windows versions 7.2 (all) and 7.4.0 through 7.4.2 contain a hard-coded cryptographic key vulnerability that allows high-privileged local attackers to disclose sensitive information. The vulnerability requires local access and administrator-level privileges, limiting its real-world exploitation scope to threats already present on compromised systems or malicious insiders. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
The vulnerability stems from the use of hard-coded cryptographic keys (CWE-321) within FortiClient Windows, a client-side endpoint security application. Hard-coded keys are embedded directly in application binaries or configuration, making them discoverable through reverse engineering or binary analysis. Unlike dynamically generated or user-supplied keys, hard-coded keys cannot be rotated per-deployment and expose all instances to identical cryptographic compromise. This weakness undermines the confidentiality guarantees of cryptographic operations, allowing attackers with local system access to decrypt sensitive data protected by the static key. The specific encryption scope (what data is protected by the compromised key) is not detailed in the CVE description.
RemediationAI
Upgrade FortiClient Windows to a patched version released after 7.4.2 or obtain the security update for version 7.2 via Fortinet's advisory FG-IR-26-129 at https://fortiguard.fortinet.com/psirt/FG-IR-26-129. For environments unable to patch immediately, restrict administrative access on endpoints running vulnerable FortiClient versions to trusted users only, as exploitation requires PR:H (administrator privileges). Monitor administrative access logs for suspicious key material extraction attempts. Note that restricting admin access may impact legitimate endpoint management workflows, so coordinate with endpoint administrators before implementation. Until patched, assume that any user or process with administrator-level access to the endpoint can potentially extract data encrypted by the hard-coded key.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today