CVE-2026-39810

MEDIUM6.0

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7

Published Apr 14, 2026

Modified 1 weeks ago

Details

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosure via decrypting database dump.

Affected Packages

FortiClient

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

References

ADVISORY

https://fortiguard.fortinet.com/psirt/FG-IR-26-107

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-39810

Aliases

FG-IR-26-107

CVSS Analysis

CVSS v3.1

5.2

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

HighPR:H

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

5.2/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

Weakness Type (CWE)

Other

CWE-321

Ecosystems(18)

Windows 10 (1507)Windows 10 (1607) / Server 2016 Windows 10 (1809) / Server 2019 Windows 10 (1903)Windows 10 (1909)

Timeline

PublishedApr 14, 2026

ModifiedApr 14, 2026