CVE-2026-44278

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>

CVSS v3 2.3 LOW

2.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-129	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de uso de clave criptográfica codificada de forma rígida en Fortinet FortiClientWindows 7.4.0 hasta 7.4.2, FortiClientWindows 7.2 todas las versiones podría permitir al atacante la revelación de información a través de <insertar vector de ataque aquí>

Information

Published : 2026-05-12 18:17

Updated : 2026-10-26 18:10

NVD link : CVE-2026-44278

Mitre link : CVE-2026-44278

CVE.ORG link : CVE-2026-44278

JSON object : View

Products Affected

fortinet

forticlient

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2026-44278", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44278", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T18:59:50.445107Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiClientWindows", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.2"}, {"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.14"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-12T18:17:30.177", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-129", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>"}, {"lang": "es", "value": "Una vulnerabilidad de uso de clave criptogr\u00e1fica codificada de forma r\u00edgida en Fortinet FortiClientWindows 7.4.0 hasta 7.4.2, FortiClientWindows 7.2 todas las versiones podr\u00eda permitir al atacante la revelaci\u00f3n de informaci\u00f3n a trav\u00e9s de <insertar vector de ataque aqu\u00ed>"}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "8F59B977-DF9D-40E1-9946-15E80FBB11BD", "versionEndExcluding": "7.4.3", "versionStartIncluding": "7.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}