# CVE-2026-44278: Fortinet FortiClientWindows hard-coded cryptographic key in GUI

Source: https://junglewise.ai/threats/cve-2026-44278-fortinet-forticlientwindows-hard-coded-cryptographic-key-in-gui  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-44278 · Severity: low · CVSS 2.3 · Published 2026-05-12

FortiClient is an endpoint security application used to provide secure VPN access to corporate networks. A security flaw in the Windows version of this software could allow a local attacker with high privileges to recover saved VPN passwords. This could lead to unauthorized access to the corporate network if the attacker manages to compromise a user's workstation.

Technologies: [Fortinet Forticlient](https://junglewise.ai/threats/technologies/forticlient). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2026-44278 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44278 being exploited in the wild.

**How severe is CVE-2026-44278?** Low severity, with a CVSS score of 2.3, published 12 May 2026.

**Which products and versions are affected?** Fortinet FortiClient Windows 7.4.0 through 7.4.2, 7.2 all versions.

**Is there a fix for CVE-2026-44278?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44278 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-44278?** Check whether you run Fortinet Forticlient, Fortinet FortiClient for Windows or Fortinet FortiClient Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use of a hard-coded cryptographic key (CWE-321) and missing authorization (CWE-862) exists in the FortiClient Windows GUI component. The vulnerability stems from an unprotected DLL function that utilizes a static key for encrypting saved VPN credentials. An authenticated local attacker with high privileges (PR:H) can exploit this to decrypt the VPN password of the currently logged-in user. The issue affects FortiClientWindows versions 7.4.0 through 7.4.2 and all versions of 7.2. Users are advised to upgrade to version 7.4.3 or later.

## Affected products

- Fortinet FortiClientWindows 7.4.0 through 7.4.2, 7.2 all versions

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-129](https://fortiguard.fortinet.com/psirt/FG-IR-26-129)

## Related threats

- [Fortinet FortiClient Windows arbitrary process termination in minifilter driver](https://junglewise.ai/threats/cve-2026-84386-fortinet-forticlient-windows-arbitrary-process-termination-in)
- [A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows…](https://junglewise.ai/threats/cve-2026-70465-a-buffer-copy-without-checking-size-of-input-classic-buffer)
- [An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0…](https://junglewise.ai/threats/cve-2025-54660-an-active-debug-code-vulnerability-in-fortinet-forticlientwindows)
- [An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows…](https://junglewise.ai/threats/cve-2025-47761-an-exposed-ioctl-with-insufficient-access-control-vulnerability)
- [A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.](https://junglewise.ai/threats/cve-2025-46373-a-heap-based-buffer-overflow-vulnerability-cwe-122-vulnerability)