PSIRT Advisory

FortiClient for Windows Insecure Temporary File vulnerability


An Insecure Temporary File (CWE-377) vulnerability in FortiClient for Windows may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.


Improper Access Control, Privilege Escalation

Affected Products

FortiClient for Windows 6.2.1 and below


Please upgrade to FortiClient for Windows version 6.2.2 or above


Fortinet is pleased to thank Lasse Trolle Borup of Danish Cyber Defence for reporting this issue under responsible disclosure.