EUVD-2026-29730
GHSA-5f54-54jr-q897
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>
AnalysisAI
Fortinet FortiClient Windows versions 7.2 (all) and 7.4.0 through 7.4.2 contain a hard-coded cryptographic key vulnerability that allows high-privileged local attackers to disclose sensitive information. The vulnerability requires local access and administrator-level privileges, limiting its real-world exploitation scope to threats already present on compromised systems or malicious insiders. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
The vulnerability stems from the use of hard-coded cryptographic keys (CWE-321) within FortiClient Windows, a client-side endpoint security application. Hard-coded keys are embedded directly in application binaries or configuration, making them discoverable through reverse engineering or binary analysis. Unlike dynamically generated or user-supplied keys, hard-coded keys cannot be rotated per-deployment and expose all instances to identical cryptographic compromise. This weakness undermines the confidentiality guarantees of cryptographic operations, allowing attackers with local system access to decrypt sensitive data protected by the static key. The specific encryption scope (what data is protected by the compromised key) is not detailed in the CVE description.
RemediationAI
Upgrade FortiClient Windows to a patched version released after 7.4.2 or obtain the security update for version 7.2 via Fortinet's advisory FG-IR-26-129 at https://fortiguard.fortinet.com/psirt/FG-IR-26-129. For environments unable to patch immediately, restrict administrative access on endpoints running vulnerable FortiClient versions to trusted users only, as exploitation requires PR:H (administrator privileges). Monitor administrative access logs for suspicious key material extraction attempts. Note that restricting admin access may impact legitimate endpoint management workflows, so coordinate with endpoint administrators before implementation. Until patched, assume that any user or process with administrator-level access to the endpoint can potentially extract data encrypted by the hard-coded key.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today