Fortinet Forticlient vulnerabilities

CVE-2022-42470 [HIGH] CWE-23 CVE-2022-42470: A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4 A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specific named pipe.

CVE-2023-45588 [HIGH] CWE-73 CVE-2023-45588: An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process.

CVE-2019-5589 [HIGH] CWE-426 CVE-2019-5589: An Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6) m An Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6) may allow an unauthenticated, remote attacker with control over the directory in which FortiClientOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious .dll files in that directory.

CVE-2019-15711 [HIGH] CVE-2019-15711: A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege via injecting specially crafted "ExportLogs" type IPC client requests to the fctsched process.

CVE-2021-26089 [HIGH] CWE-59 CVE-2021-26089: An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged use An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase.

CVE-2024-31492 [HIGH] CWE-73 CVE-2024-31492: An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process.

CVE-2020-15934 [HIGH] CWE-269 CVE-2020-15934: An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux ve An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. may allow local users to elevate their privileges to root by creating a malicious script or program on the target machine.

CVE-2025-25251 [HIGH] CWE-863 CVE-2025-25251: An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 thr An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker to escalate privileges via crafted XPC messages.

CVE-2022-40682 [HIGH] CWE-863 CVE-2022-40682: A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6. A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specific named pipe.

CVE-2023-22635 [HIGH] CWE-494 CVE-2023-22635: A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 t A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions, 5.6 all versions, 5.4 all versions, 5.2 all versions, 5.0 all versions and 4.0 all versions may allow a local attacker to escalate their privileges via modifying the installer upon upgr

CVE-2024-35281 [HIGH] CWE-653 CVE-2024-35281: An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4. An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variables.

CVE-2025-31365 [HIGH] CWE-94 CVE-2025-31365: An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMa An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an unauthenticated attacker to execute arbitrary code on the victim's host via tricking the user into visiting a malicious website.

CVE-2021-41031 [HIGH] CWE-22 CVE-2021-41031: A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service.

CVE-2025-46774 [HIGH] CWE-347 CVE-2025-46774: An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS ins An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executables.

CVE-2018-13368 [HIGH] CVE-2018-13368: A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker t A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker to execute unauthorized code or commands via the command injection.

CVE-2019-17650 [HIGH] CWE-78 CVE-2019-17650: An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the system on which FortiClient is running to execute unauthorized code as root by bypassing a security check.

CVE-2021-36183 [HIGH] CVE-2021-36183: An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and belo An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for Forticlient updates.

CVE-2024-36507 [HIGH] CWE-426 CVE-2024-36507: A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social engineering.

CVE-2021-43066 [HIGH] CWE-668 CVE-2021-43066: A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, vers A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer.

CVE-2017-17543 [HIGH] CWE-326 CVE-2017-17543: Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6 Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms.