# CVE-2026-121527: Fortinet FortiClientEMS privilege escalation via CLI commands

Source: https://junglewise.ai/threats/cve-2026-121527-a-execution-with-unnecessary-privileges-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-121527 · Severity: medium · CVSS 6.7 · Published 2026-11-11

FortiClientEMS is a centralized management platform for Fortinet endpoint security clients. A privilege escalation flaw allows authenticated administrators with local access to gain root shell access through CLI commands, enabling complete system compromise and potential lateral movement to managed endpoints.

Technologies: [Fortinet Forticlientems](https://junglewise.ai/threats/technologies/forticlientems). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2026-121527 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121527 being exploited in the wild.

**How severe is CVE-2026-121527?** Medium severity, with a CVSS score of 6.7, published 11 November 2026.

**Which products and versions are affected?** Fortinet Forticlientems 7.2 all versions, 7.4.0 through 7.4.7.

**Is there a fix for CVE-2026-121527?** Yes: fixed in FortiClientEMS 7.4.8 and above; FortiClientEMS 8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121527 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-121527?** Check whether you run Fortinet Forticlientems at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FortiClientEMS 7.4.8 and above; FortiClientEMS 8.0

## Technical details

An execution with unnecessary privileges vulnerability (CWE-250) in the CLI component allows authenticated local attackers with admin privileges to escalate to root shell access. The vulnerability requires authentication and local access, and affects FortiClientEMS versions 7.2 (all versions) and 7.4.0-7.4.7. FortiClientEMS 8.0 is unaffected, and fixes are available in versions 7.4.8 and above.

## Affected products

- Fortinet FortiClientEMS 7.2 all versions, 7.4.0 through 7.4.7

## Timeline

- 2026-11-10: disclosed
- 2026-11-11: advisory

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-192](https://fortiguard.fortinet.com/psirt/FG-IR-26-192)

## Related threats

- [A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker…](https://junglewise.ai/threats/cve-2026-39810-a-use-of-hard-coded-cryptographic-key-vulnerability-in-fortinet)
- [A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet…](https://junglewise.ai/threats/cve-2026-39809-a-improper-neutralization-of-special-elements-used-in-an-sql)
- [Fortinet FortiClientEMS improper access control in API](https://junglewise.ai/threats/cve-2026-35616-fortinet-forticlientems-improper-access-control-in-api)