# CVE-2026-84386: Fortinet FortiClient Windows arbitrary process termination in minifilter driver

Source: https://junglewise.ai/threats/cve-2026-84386-fortinet-forticlient-windows-arbitrary-process-termination-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84386 · Severity: medium · CVSS 5.1 · Published 2026-09-08

Fortinet FortiClient Windows is an endpoint security client deployed on employee workstations. An authenticated attacker can terminate arbitrary processes on an affected system by exploiting an unverified ownership vulnerability in the minifilter communication driver, potentially disrupting business operations or disabling security controls.

Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2026-84386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84386 being exploited in the wild.

**How severe is CVE-2026-84386?** Medium severity, with a CVSS score of 5.1, published 8 September 2026.

**Which products and versions are affected?** Fortinet FortiClient Windows 7.2 all versions, 7.4.0 through 7.4.7.

**Is there a fix for CVE-2026-84386?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84386 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-84386?** Check whether you run Fortinet FortiClient Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unverified ownership issue (CWE-283) in the fortimon3 minifilter driver that allows an authenticated attacker to terminate arbitrary processes via an exposed minifilter communication port. The attack requires local system access and authentication but no elevated privileges. An attacker with valid credentials or local access can use this exposed communication channel to send termination commands to the kernel driver, affecting any running process. The vulnerability affects FortiClient Windows versions 7.2 (all versions) and 7.4.0 through 7.4.7; users are advised to upgrade to version 7.4.8 or migrate to version 8.0.

## Affected products

- Fortinet FortiClient Windows 7.2 all versions, 7.4.0 through 7.4.7

## Timeline

- 2026-09-08: disclosed

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-165](https://fortiguard.fortinet.com/psirt/FG-IR-26-165)

## Related threats

- [Fortinet FortiClientWindows hard-coded cryptographic key in GUI](https://junglewise.ai/threats/cve-2026-44278-fortinet-forticlientwindows-hard-coded-cryptographic-key-in-gui)