FortiClientWindows CVE-2026-70465

Exploitation requires the attacker to be in a position to alter or craft DNS responses delivered to the target host - this is the primary limiting condition reflected in AC:H. Concrete methods include DNS cache poisoning of an upstream resolver, operating a rogue DNS server on a shared network segment (public WiFi, hotel, conference networks), or performing ARP spoofing/MITM on the local LAN. The FortiClientWindows process must actively perform DNS resolution (standard behavior during normal operation) for the malicious response to be parsed. No authentication, credentials, or user interaction are required once the attacker controls the DNS response channel. Exploitation is limited to Windows hosts running FortiClientWindows 7.2.0-7.2.11 or 7.4.0-7.4.3; updated versions, non-Windows platforms, and hosts using DNSSEC-validated or authenticated DNS transport (DoH/DoT) reduce or eliminate exposure.

The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the technical impact - full confidentiality, integrity, and availability compromise - while the High complexity rating (AC:H) reflects the non-trivial prerequisite of controlling or intercepting DNS traffic. This is not a trivial internet-scale spray attack; exploitation requires targeted positioning. Real-world risk is therefore elevated for threat models involving nation-state actors, corporate espionage targeting VPN clients over untrusted networks (public WiFi, conference networks, hotel networks), or environments where DNS infrastructure has already been compromised. No EPSS score is available in the provided data. No CISA KEV listing and no public proof-of-concept code are identified at time of analysis, which reduces immediate broad exploitation probability. However, FortiClient's enterprise deployment footprint and the severity of the impact (unauthenticated RCE on an endpoint security tool) make this a meaningful patching priority, particularly for organizations with mobile workforces operating on untrusted networks.

An attacker targeting an enterprise employee on a public or compromised network performs DNS cache poisoning or ARP-based MITM to intercept DNS resolution traffic from the victim's FortiClientWindows host. The attacker responds with a crafted, oversized DNS response packet that overflows a fixed-size buffer in the FortiClient DNS parsing routine, overwriting return addresses or function pointers. With no public proof-of-concept identified at time of analysis, exploitation likely requires moderate reverse engineering effort, but successful exploitation yields arbitrary code execution on the endpoint without any user interaction.