Local Privilege Escalation in Fortinet FortiClient (CVE‑2026‑24018) Threatens Enterprise Endpoints

Local Privilege Escalation in Fortinet FortiClient (CVE‑2026‑24018) Threatens Enterprise Endpoints

What It Is — Fortinet FortiClient contains a local privilege‑escalation flaw (CVE‑2026‑24018) that lets an attacker who can run low‑privileged code create a malicious symbolic link, forcing the client to load arbitrary shared objects and gain root privileges.

Exploitability — The vulnerability is locally exploitable; no public exploit code has been released, but the attack requires only low‑privilege code execution. CVSS 7.8 (High).

Affected Products — Fortinet FortiClient (all supported Windows versions).

TPRM Impact — FortiClient is widely deployed as an endpoint‑security agent across multiple industries. A compromised client can become a foothold for attackers to move laterally within a supplier’s network, potentially exposing downstream customers’ data or disrupting services.

Recommended Actions —

1. Deploy Fortinet’s advisory update FG‑IR‑26‑083 immediately on all FortiClient installations.
2. Verify that endpoint management tools enforce the latest version and block legacy binaries.
3. Conduct a rapid inventory of all assets running FortiClient and confirm patch compliance.
4. Review privileged‑access controls on endpoints to limit the impact of any low‑privilege compromise.
5. Update third‑party risk registers to reflect the new vulnerability and adjust risk scores for vendors using FortiClient.

Source: Zero Day Initiative Advisory ZDI‑26‑186