CVE-2026-24018
Received
Received - Intake
Symlink Vulnerability in FortiClientLinux Enables Local Root Escalation
Publication date: 2026-03-10
Last updated on: 2026-03-13
Assigner: Fortinet, Inc.
Description
Description
A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.12 may allow a local and unprivileged user to escalate their privileges to root.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | forticlient | From 7.2.2 (inc) to 7.2.13 (exc) |
| fortinet | forticlient | From 7.4.0 (inc) to 7.4.5 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
