Vulnerability-Lookup

CVE-2026-44278 (GCVE-0-2026-44278)

Vulnerability from cvelistv5 – Published: 2026-05-12 16:54 – Updated: 2026-05-14 15:28

Summary

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>

Severity

2.1 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-12 18:59 UTC

CWE

CWE-321 - Information disclosure

Assigner

fortinet mitre root

References

1 reference

URL	Tags
https://fortiguard.fortinet.com/psirt/FG-IR-26-129

Impacted products

1 product

Vendor	Product	Version	CPE status
Fortinet	FortiClientWindows	Affected: 7.4.0 , ≤ 7.4.2 (semver) Affected: 7.2.0 , ≤ 7.2.14 (semver) cpe:2.3:a:fortinet:forticlientwindows:7.4.2:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.4.1:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.4.0:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.14:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.13:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.12:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.11:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.10:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.9:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.8:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.7:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.6:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.5:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.4:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.3:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.2:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.1:::::::* cpe:2.3:a:fortinet:forticlientwindows:7.2.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T18:59:50.445107Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T19:02:43.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiClientWindows",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.4.2",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.14",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via \u003cinsert attack vector here\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "Information disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T15:28:56.927Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-129",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-129"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiClientWindows version 7.4.3 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-44278",
    "datePublished": "2026-05-12T16:54:09.226Z",
    "dateReserved": "2026-05-05T17:24:17.727Z",
    "dateUpdated": "2026-05-14T15:28:56.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44278",
      "date": "2026-09-24",
      "epss": "0.00139",
      "percentile": "0.02662"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.14:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.13:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiClientWindows",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.4.2",
                    "status": "affected",
                    "version": "7.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.14",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@fortinet.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "8F59B977-DF9D-40E1-9946-15E80FBB11BD",
                    "versionEndExcluding": "7.4.3",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via \u003cinsert attack vector here\u003e"
          }
        ],
        "id": "CVE-2026-44278",
        "lastModified": "2026-06-17T10:50:26.020",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 2.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 1.4,
              "source": "psirt@fortinet.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-44278",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T18:59:50.445107Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-12T18:17:30.177",
        "references": [
          {
            "source": "psirt@fortinet.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-129"
          }
        ],
        "sourceIdentifier": "psirt@fortinet.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-321"
              }
            ],
            "source": "psirt@fortinet.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-14T19:58:28+00:00",
      "cve": "CVE-2026-44278",
      "id": "CVE-2026-44278",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2026-44278",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44278.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-44278",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-12T18:59:50.445107Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-12T19:02:39.152Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.14:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.13:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiClientWindows",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.4.2",
                  "status": "affected",
                  "version": "7.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.2.14",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via \u003cinsert attack vector here\u003e"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-321",
                  "description": "Information disclosure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-14T15:28:56.927Z",
            "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
            "shortName": "fortinet"
          },
          "references": [
            {
              "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-129",
              "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-129"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to FortiClientWindows version 7.4.3 or above"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "assignerShortName": "fortinet",
        "cveId": "CVE-2026-44278",
        "datePublished": "2026-05-12T16:54:09.226Z",
        "dateReserved": "2026-05-05T17:24:17.727Z",
        "dateUpdated": "2026-05-14T15:28:56.927Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0575

Vulnerability from certfr_avis - Published: 2026-05-13 - Updated: 2026-05-13

De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Fortinet	FortiOS	FortiOS versions 7.6.x antérieures à 7.6.4
Fortinet	FortiAP	FortiAP-W2 versions antérieures à 7.4.5
Fortinet	FortiMail	FortiMail versions 7.6.x antérieures à 7.6.4
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.6.x antérieures à 7.6.5
Fortinet	FortiSandbox	FortiSandbox PaaS 21.x, 22.x, et 23.x toutes versions
Fortinet	FortiSandbox	FortiSandbox PaaS versions 4.4.x antérieures à 4.4.9
Fortinet	FortiAP	FortiAP versions 7.6.x antérieures à 7.6.3
Fortinet	FortiAP	FortiAP-U versions 7.0.x antérieures à 7.0.6
Fortinet	FortiDeceptor	FortiDeceptor versions 5.x et 6.x antérieures à 6.1
Fortinet	FortiSandbox	FortiSandbox Cloud 24 toutes versions
Fortinet	FortiManager	FortiManager versions 7.6.x antérieures à 7.6.5
Fortinet	FortiClient	FortiClientWindows versions antérieures à 7.4.3
Fortinet	FortiSandbox	FortiSandbox versions 4.4.x antérieures à 4.4.9
Fortinet	FortiOS	FortiOS versions 7.4.x antérieures à 7.4.9
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.12
Fortinet	FortiMail	FortiMail versions 7.4.x antérieures à 7.4.6
Fortinet	FortiSandbox	FortiSandbox versions 5.x antérieures à 5.0.2
Fortinet	N/A	FortiTokenAndroid versions antérieures à 6.4
Fortinet	FortiAuthenticator	FortiAuthenticator versions 6.5.x antérieures à 6.5.7
Fortinet	FortiManager	FortiManager versions antérieures à 7.4.9
Fortinet	FortiSandbox	FortiSandbox Cloud 23 toutes versions
Fortinet	FortiNDR	FortiNDR versions 7.6.x antérieures à 7.6.3
Fortinet	FortiSandbox	FortiSandbox Cloud versions 5.x antérieures à 5.0.6
Fortinet	FortiAuthenticator	FortiAuthenticator versions 6.6.x antérieures à 6.6.9
Fortinet	FortiAnalyzer	FortiAnalyzer versions antérieures à 7.4.9
Fortinet	FortiMail	FortiMail versions 7.2.x antérieures à 7.2.9
Fortinet	FortiNDR	FortiNDR versions 7.x antérieures à 7.4.10
Fortinet	FortiAP	FortiAP versions antérieures à 7.4.6
Fortinet	FortiSandbox	FortiSandbox PaaS versions 5.0.x antérieures à 5.0.2
Fortinet	FortiAuthenticator	FortiAuthenticator versions 8.0.x antérieures à 8.0.3

References

Title

Publication Time

Tags

Bulletin de sécurité Fortinet FG-IR-26-137	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-133	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-138	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-130	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-134	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-136	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-123	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-129	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-128	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-132	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-131	2026-05-12	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiOS versions 7.6.x ant\u00e9rieures \u00e0 7.6.4",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAP-W2 versions ant\u00e9rieures \u00e0 7.4.5",
      "product": {
        "name": "FortiAP",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.6.x ant\u00e9rieures \u00e0 7.6.4",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.6.x ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox PaaS 21.x, 22.x, et 23.x toutes versions",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox PaaS versions 4.4.x ant\u00e9rieures \u00e0 4.4.9",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAP versions 7.6.x ant\u00e9rieures \u00e0 7.6.3",
      "product": {
        "name": "FortiAP",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAP-U versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
      "product": {
        "name": "FortiAP",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiDeceptor versions 5.x et 6.x ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "FortiDeceptor",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox Cloud 24 toutes versions",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.6.x ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientWindows versions ant\u00e9rieures \u00e0 7.4.3",
      "product": {
        "name": "FortiClient",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox versions 4.4.x ant\u00e9rieures \u00e0 4.4.9",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.4.x ant\u00e9rieures \u00e0 7.4.9",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.4.x ant\u00e9rieures \u00e0 7.4.6",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox versions 5.x ant\u00e9rieures \u00e0 5.0.2",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiTokenAndroid versions ant\u00e9rieures \u00e0 6.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAuthenticator versions 6.5.x ant\u00e9rieures \u00e0 6.5.7",
      "product": {
        "name": "FortiAuthenticator",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions ant\u00e9rieures \u00e0 7.4.9",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox Cloud 23 toutes versions",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNDR versions 7.6.x ant\u00e9rieures \u00e0 7.6.3",
      "product": {
        "name": "FortiNDR",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox Cloud versions 5.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAuthenticator versions 6.6.x ant\u00e9rieures \u00e0 6.6.9",
      "product": {
        "name": "FortiAuthenticator",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions ant\u00e9rieures \u00e0 7.4.9",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.2.x ant\u00e9rieures \u00e0 7.2.9",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNDR versions 7.x ant\u00e9rieures \u00e0 7.4.10",
      "product": {
        "name": "FortiNDR",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAP versions ant\u00e9rieures \u00e0 7.4.6",
      "product": {
        "name": "FortiAP",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox PaaS versions 5.0.x ant\u00e9rieures \u00e0 5.0.2",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAuthenticator versions 8.0.x ant\u00e9rieures \u00e0 8.0.3",
      "product": {
        "name": "FortiAuthenticator",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-44279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44279"
    },
    {
      "name": "CVE-2026-25690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25690"
    },
    {
      "name": "CVE-2026-44277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44277"
    },
    {
      "name": "CVE-2025-53844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53844"
    },
    {
      "name": "CVE-2025-53681",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53681"
    },
    {
      "name": "CVE-2026-26083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26083"
    },
    {
      "name": "CVE-2025-67604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-67604"
    },
    {
      "name": "CVE-2026-44278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44278"
    },
    {
      "name": "CVE-2025-53680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53680"
    },
    {
      "name": "CVE-2025-53870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53870"
    },
    {
      "name": "CVE-2026-25088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25088"
    }
  ],
  "initial_release_date": "2026-05-13T00:00:00",
  "last_revision_date": "2026-05-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0575",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Fortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-137",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-137"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-133",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-133"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-138",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-138"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-130",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-130"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-134",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-134"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-136",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-136"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-123",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-123"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-129",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-129"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-128",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-128"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-132",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-132"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-131",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-131"
    }
  ]
}

FKIE_CVE-2026-44278

Vulnerability from fkie_nvd - Published: 2026-05-12 18:17 - Updated: 2026-06-17 10:50

Severity

2.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	psirt@fortinet.com	https://fortiguard.fortinet.com/psirt/FG-IR-26-129	Vendor Advisory

Impacted products

	Vendor	Product	Version
	fortinet	forticlient	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiClientWindows",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.4.2",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.14",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "8F59B977-DF9D-40E1-9946-15E80FBB11BD",
              "versionEndExcluding": "7.4.3",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via \u003cinsert attack vector here\u003e"
    }
  ],
  "id": "CVE-2026-44278",
  "lastModified": "2026-06-17T10:50:26.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 1.4,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44278",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-12T18:59:50.445107Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-12T18:17:30.177",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-129"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5F54-54JR-Q897

Vulnerability from github – Published: 2026-05-12 18:30 – Updated: 2026-05-12 18:30

Details

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via

Severity

2.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-44278"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-12T18:17:30Z",
    "severity": "LOW"
  },
  "details": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via \u003cinsert attack vector here\u003e",
  "id": "GHSA-5f54-54jr-q897",
  "modified": "2026-05-12T18:30:47Z",
  "published": "2026-05-12T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44278"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-129"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1491

Vulnerability from csaf_certbund - Published: 2026-05-12 22:00 - Updated: 2026-05-12 22:00

Summary

Fortinet FortiClient: Schwachstelle ermöglicht Offenlegung von Informationen

Severity

Niedrig

Scope

1 vulnerability in this advisory, including CVE-2026-44278.

CVE-2026-44278

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-44278 (GCVE-0-2026-44278)

CERTFR-2026-AVI-0575

Solutions

FKIE_CVE-2026-44278

GHSA-5F54-54JR-Q897

WID-SEC-W-2026-1491

Tags

Sightings

Nomenclature

Related by attack behaviour