EUVD-2026-22339
GHSA-pgp9-vrph-v4j2
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosure via <insert attack vector here>
AnalysisAI
Hard-coded cryptographic keys in Fortinet FortiClientEMS 7.4.0 through 7.4.5 allow local authenticated attackers with high privileges to disclose sensitive information and potentially modify system configurations. An attacker with administrative access can extract or leverage these embedded keys to compromise confidentiality and integrity of protected data. This vulnerability requires local access and elevated privileges, limiting but not eliminating real-world risk in multi-user or compromised endpoint scenarios.
Technical ContextAI
FortiClientEMS (Endpoint Management Server) versions 7.4.0 to 7.4.5 contain hard-coded cryptographic keys embedded in the application code or configuration files. CWE-321 (Use of Hard-Coded Cryptographic Key) represents a fundamental cryptographic implementation flaw where keys are static and discoverable through reverse engineering, code analysis, or file examination rather than being dynamically generated or securely managed. This allows attackers to decrypt encrypted communications, authenticate as the application, or access protected credentials. The vulnerability is rooted in insecure cryptographic practices and affects the CPE cpe:2.3:a:fortinet:forticlientems, which is Fortinet's centralized management solution for FortiClient endpoints across enterprise networks.
RemediationAI
Upgrade Fortinet FortiClientEMS to a patched version released after 7.4.5, which should include cryptographic key remediation and secure key management implementation. Organizations unable to upgrade immediately should restrict administrative access to FortiClientEMS systems to only essential personnel, enforce multi-factor authentication for administrative logins, monitor for unauthorized access to cryptographic material or configuration files, and consider network segmentation of the EMS server to reduce lateral movement risk if an admin account is compromised. Consult the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-107 for the exact patched version availability and timeline.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attac
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today