CVE-2026-24018

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24018", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-01-20T11:13:10.549Z", "datePublished": "2026-03-10T16:44:14.285Z", "dateUpdated": "2026-11-06T15:42:11.260Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiClientLinux", "cpes": ["cpe:2.3:a:fortinet:forticlientlinux:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.2:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.4", "status": "affected"}, {"versionType": "semver", "version": "7.2.2", "lessThanOrEqual": "7.2.12", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.12 may allow a local and unprivileged user to escalate their privileges to root."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:11.260Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-61", "description": "Escalation of privilege", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiClientLinux version 8.0.0 or above\nUpgrade to FortiClientLinux version 7.4.5 or above\nUpgrade to FortiClientLinux version 7.2.13 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-083", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-083"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24018", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T03:56:55.161799Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:08:18.944Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24018", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T03:56:55.161799Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:02:48.652Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:forticlientlinux:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.2:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiClientLinux", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.4"}, {"status": "affected", "version": "7.2.2", "versionType": "semver", "lessThanOrEqual": "7.2.12"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiClientLinux version 8.0.0 or above\nUpgrade to FortiClientLinux version 7.4.5 or above\nUpgrade to FortiClientLinux version 7.2.13 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-083", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-083"}], "descriptions": [{"lang": "en", "value": "A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.12 may allow a local and unprivileged user to escalate their privileges to root."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "Escalation of privilege"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:11.260Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24018", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:11.260Z", "dateReserved": "2026-01-20T11:13:10.549Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-03-10T16:44:14.285Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:forticlientlinux:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientlinux:7.2.2:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiClientLinux", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "7.4.4", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.12", "status": "affected", "version": "7.2.2", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*", "matchCriteriaId": "C00E2D97-4175-47C4-82F0-BB30DD1B8314", "versionEndExcluding": "7.2.13", "versionStartIncluding": "7.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*", "matchCriteriaId": "022517B5-255A-4794-9813-2987CDBDAC43", "versionEndExcluding": "7.4.5", "versionStartIncluding": "7.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.12 may allow a local and unprivileged user to escalate their privileges to root."}, {"lang": "es", "value": "Una vulnerabilidad de seguimiento de enlaces simb\u00f3licos (Symlink) de UNIX en Fortinet FortiClientLinux 7.4.0 hasta 7.4.4, FortiClientLinux 7.2.2 hasta 7.2.12 puede permitir a un usuario local y no privilegiado escalar sus privilegios a root."}], "id": "CVE-2026-24018", "lastModified": "2026-06-17T10:22:28.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24018", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T03:56:55.161799Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:17.560", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-083"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-61"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.4.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.2,7.2.12]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FortiClientLinux", "source": "cna", "vendor": "Fortinet"}, "product": "forticlientlinux", "vendor": "fortinet"}], "analysis": {"en": {"generated_at": "2026-04-16T09:45:07.534673+00:00", "value": {"mitigation_remediation": ["Upgrade FortiClientLinux to version 8.0.0 or later.", "If version 8.0.0 is unavailable, upgrade to 7.4.5 or later.", "If that is not possible, upgrade to 7.2.13 or later."], "summary": {"action": "Immediate Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Fortinet FortiClientLinux on Linux operating systems is affected. The vulnerability exists in versions 7.4.0 through 7.4.4 and in 7.2.2 through 7.2.12. Users running any of these releases should verify the current installed version against the list above.", "description_and_impact": "FortiClientLinux contains a flaw where the application follows symbolic links without proper checks. An authenticated, unprivileged local user can exploit this behaviour to gain root privileges. The weakness is classified as CWE-61, reflecting incorrect handling of path traversal through symlinks.", "risk_and_exploitability": "CVSS score is 7.4 indicating high severity. The EPSS indicates low exploitation probability (< 1%). The vulnerability is local, requiring the attacker to have a user account on the same host. No public exploit is reported and it is not listed in the CISA Known Exploit Catalog. However, because privilege escalation to root can enable arbitrary system changes, the risk remains significant for any machine with exposed local users. The official recommendation is to apply a patch that removes the insecure symlink handling."}}}}, "created": "2026-03-11T11:49:29.358844+00:00", "title": "Unix Symlink Follow Vulnerability Allows Local Privilege Escalation", "updated": "2026-04-16T09:45:31.681131+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$forticlientlinux"]}