CVE-2026-44278
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2 and FortiClientWindows 7.2 all versions may allow an attacker to disclose information.
Risk Assessment
A hard-coded cryptographic key could be exploited by an attacker to access protected information.
Recommendation
Update FortiClientWindows to a patched version or contact the vendor for guidance.
Other vulnerabilities in FortiClientWindows
See all- CVE-2026-84386Medium
A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7 and 7.2 all versions may allow attacker to improper access control via an exposed minifilter communication port.
- CVE-2025-54660Medium
FortiClientWindows versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.10, and all versions of 7.0 contain active debug code that may allow a local attacker to run the application step by step and retrieve the saved VPN user password.
- CVE-2025-47761High
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in Fortinet FortiClientWindows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via the fortips driver. A successful attack requires bypassing Windows memory protections such as Heap integrity and HSP, and an active VPN IPSec connection.
- CVE-2025-46373High
A Heap-based Buffer Overflow vulnerability [CWE-122] in Fortinet FortiClientWindows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.8 may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys". The attacker would need to bypass the Windows heap integrity protections.
Original NVD description (English source)
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS