CVE-2026-70465

No known exploitation. EPSS puts it in the 41st percentile. A vendor fix is available.

CVSS 3.18.1High EPSS percentile41st0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-12Updated 2026-09-08Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Windows device is running FortiClientWindows in versions 7.4.0–7.4.3 or 7.2.0–7.2.11.
If it is, update FortiClientWindows to 7.4.4 or above, or to 7.2.12 or above.
Verify the update completed successfully and FortiClientWindows now shows the fixed version in your installed software list.
If you cannot update right away, restrict network/DNS access so external parties cannot influence the DNS responses processed by the FortiClientWindows host.

Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.11 may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets.

In plain language

Written by AI from the record

CVE-2026-70465 is a FortiClient Windows flaw where an attacker can send specially crafted DNS messages to make the app run any code on your computer—if you’re using FortiClient versions 7.4.0–7.4.3 or 7.2.0–7.2.11, you should update.

Unauthenticated classic buffer overflow (CWE-120) in Fortinet FortiClientWindows that can be triggered by processing attacker-controlled DNS responses, potentially leading to arbitrary code execution on the host.

If you're affected

Full device takeover via code execution
Data theft from your account access
Malware installed and persistence
Service disruption and loss of control

What is it

Think of FortiClient Windows as software that reads network “instructions” (DNS messages) to make connections work. This bug happens when it accepts a specially malformed DNS message that’s too large for what it expects, which can let an attacker cause the program to run attacker-supplied code. In plain terms: a bad DNS message can be used to take control of the computer running FortiClient.

Who is affected

This matters to you if your business uses Fortinet FortiClientWindows on Windows machines that are running version 7.4.0–7.4.3 or 7.2.0–7.2.11. It only becomes a risk when the affected machine processes DNS responses coming from an attacker-controlled source (for example, if an attacker can influence DNS answers sent to that device). The vulnerability does not require a login or user interaction to be exploited.

How urgent is it

This is a RED item because the flaw allows an unauthenticated attacker to get arbitrary code execution by sending malicious DNS responses over the network. Even though there are no clear public incident reports for this exact CVE, the class of bug and the ability to run code makes it something you must address now—especially on internet-exposed or attacker-influenced networks.

What to do — in detail

Confirm exposure (inventory):
- On each Windows endpoint, open “Apps & Features” (or the software inventory tool you use) and check the installed FortiClientWindows version.
- Mark machines running FortiClientWindows 7.4.0, 7.4.1, 7.4.2, 7.4.3, or any of 7.2.0 through 7.2.11.
Remediate (upgrade to the fixed builds):
- Upgrade FortiClientWindows to 7.4.4 or above (for the 7.4 line) or 7.2.12 or above (for the 7.2 line).
- Apply the update to all affected endpoints, and confirm afterward that the installed version matches the fixed threshold.
If you cannot patch immediately (containment while you upgrade):
- Reduce the chance of attacker-controlled DNS responses reaching the endpoints. Practically, this means ensuring your endpoints use trusted DNS resolvers you control and preventing untrusted networks from inserting themselves between the machine and DNS.
- If endpoints move between networks (home/coffee shop/VPN), prioritize patching those most urgently because “who controls DNS” is harder to guarantee.
What to monitor:
- Watch for FortiClientWindows crashes/restarts around the time of suspicious network activity.
- Review endpoint security logs for unexpected new processes started shortly after network/DNS events.
Timing:
- No CISA KEV listing was found for CVE-2026-70465. However, given the RED verdict and code-execution risk, treat this as an immediate patch-and-verify task for affected endpoints.

Technical context

Severity is high (CVSS 8.1) with network-based, no-authentication conditions and no user interaction required. The weakness is a classic buffer overflow (CWE-120) caused by copying input without properly checking length, leading to memory corruption when FortiClientWindows processes attacker-crafted DNS responses. The attack mechanism described is: the attacker sends specially crafted DNS replies over the network to a targeted host running a vulnerable FortiClientWindows version; if the host processes those responses, arbitrary code execution may result.

KEV: not listed in CISA KEV for this CVE. Exploitation: no clear dated public claim or confirmed in-the-wild incidents were found in the provided news/traffic; no public exploit code was identified. EPSS is a low predicted likelihood and flat trend, but this is not relied upon for action because the issue is classified as RED and the capability involves direct code execution.

Patch guidance from the findings: upgrade FortiClientWindows to 7.4.4+ or 7.2.12+.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS41st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 41st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 27 days, from the signal feeds we watch.

2026-09-08Patch availablerecord updated
2026-08-26Patch availablerecord updated
2026-08-15OpenVAS check added
2026-08-13Patch availablerecord updated
2026-08-12Patch availablepublished, weakness classified, att&ck mapped, record updated

Affected products

Fortinetcommercial · USaka forti net
- forticlientSecurity Products
- FortiClientWindowsSecurity Products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable