Is CVE-2026-121527 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121527 being exploited in the wild.

How severe is CVE-2026-121527?

Medium severity, with a CVSS score of 6.7, published 11 November 2026.

Which products and versions are affected?

Fortinet Forticlientems 7.2 all versions, 7.4.0 through 7.4.7.

Is there a fix for CVE-2026-121527?

Yes: fixed in FortiClientEMS 7.4.8 and above; FortiClientEMS 8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121527 attacked?

It is attacked with local access.

Am I affected by CVE-2026-121527?

Check whether you run Fortinet Forticlientems at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121527: Fortinet FortiClientEMS privilege escalation via CLI commands

CVE-2026-121527 · Severity: medium · CVSS 6.7 · Published 2026-11-11

FortiClientEMS is a centralized management platform for Fortinet endpoint security clients. A privilege escalation flaw allows authenticated administrators with local access to gain root shell access through CLI commands, enabling complete system compromise and potential lateral movement to managed endpoints.

Technologies: Fortinet Forticlientems. Vendors: Fortinet.

Quick answers

Is CVE-2026-121527 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121527 being exploited in the wild.
How severe is CVE-2026-121527?: Medium severity, with a CVSS score of 6.7, published 11 November 2026.
Which products and versions are affected?: Fortinet Forticlientems 7.2 all versions, 7.4.0 through 7.4.7.
Is there a fix for CVE-2026-121527?: Yes: fixed in FortiClientEMS 7.4.8 and above; FortiClientEMS 8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121527 attacked?: It is attacked with local access.
Am I affected by CVE-2026-121527?: Check whether you run Fortinet Forticlientems at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiClientEMS 7.4.8 and above; FortiClientEMS 8.0

Technical details

An execution with unnecessary privileges vulnerability (CWE-250) in the CLI component allows authenticated local attackers with admin privileges to escalate to root shell access. The vulnerability requires authentication and local access, and affects FortiClientEMS versions 7.2 (all versions) and 7.4.0-7.4.7. FortiClientEMS 8.0 is unaffected, and fixes are available in versions 7.4.8 and above.

Affected products

Fortinet FortiClientEMS 7.2 all versions, 7.4.0 through 7.4.7

Timeline

2026-11-10: disclosed
2026-11-11: advisory

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-192

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.