CVE-2024-40586: Fortinet FortiClient

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow a local user to escalate his privileges via FortiSSLVPNd service pipe.

Affected products

• Fortinet FortiClient: from 7.0.3, before 7.0.14 (fixed in 7.0.14); from 7.2.0, before 7.2.7 (fixed in 7.2.7); version 7.4.0 only

Published 2025-02-11. Last modified 2026-06-17.