Fortinet has patched a flaw in FortiClient that could let an attacker run code on a Windows PC or Mac from the other side of the internet. The victim has to do something first, such as opening a page the attacker controls, so the fix is to update before anyone tries it.
Fortinet filed it under CVE-2026-121529 and describes it as an origin validation error, which means the software does not properly check where a request is coming from before acting on it. The affected products are FortiClient for Mac, FortiClient for Windows and the Windows build that includes the privileged access (PAM) agent.
Fortinet’s advisory gives two fixed releases. Anyone on the 7.4 branch should move to 7.4.8 or later, and anyone on the 7.2 branch to 7.2.15 or later. The 8.0 branch is not affected, and neither is FortiClient for Mac on 7.2.
FortiClient is a common pick for company VPN access on staff laptops, so IT teams that manage a fleet will want to check which branch each machine runs. Home users who installed it for a work VPN should open the app and look at the version number.
Fortinet’s advisory says successful exploitation requires interaction with the victim, which is why it counts as a remote flaw that still needs a nudge: phishing links, malicious ads or a compromised site are the usual ways to supply one. Staff should be reminded not to click unfamiliar links until their machines are updated, and administrators who push updates centrally can use the two fixed version numbers as their targets.
The advisory does not list any workaround, so updating is the only step it offers.
