Vulnerabilities
FortiClient Windows VPN Password Decryption via Hardcoded Key
FortiClient for Windows exposes a hard‑coded key that lets an authenticated local user decrypt stored VPN passwords. The flaw is low severity (CVSS 2.1) but can aid lateral movement. Update the client and disable password saving to mitigate.
What happened
FortiClient for Windows uses a hard‑coded encryption key to store VPN passwords. An unprotected DLL function exposes this key, letting an authenticated local user decrypt the password of any currently logged‑in user.
Impact
Local attackers can recover VPN credentials, enabling lateral movement or remote access. The flaw is low severity (CVSS 2.1) but still relevant where VPN passwords are saved.
What to do
Steps to mitigate:
- Update to the latest FortiClient release, which removes the hard‑coded key.
- Disable the “save password” feature for VPN connections.
- Enforce strong, non‑reusable local passwords and limit local privileges.
Related vulnerabilities
AD RMS Certificate Export Allows Offline Decryption of All Protected Documents
A flaw in AD Rights Management Service lets a Service Group account export the Server Licensor Certificate private key, enabling attackers to decrypt every document the deployment has protected, even after the deployment is rebuilt. Defenders should audit Service Group permissions, rotate certificates, and monitor for unauthorized key exports.
Read briefing
CVE-2026-61363: Remote Desktop Client Remote Code Execution Vulnerability
A critical RCE flaw in Windows Remote Desktop Client (CVE-2026-61363) allows attackers to execute arbitrary code via crafted RDP traffic. All Windows 10/11 and Windows Server 2022 systems are affected. Apply the latest security update and enforce NLA or VPN to mitigate.
Read briefing
Windows exFAT Elevation of Privilege Vulnerability (CVE‑2026‑69619) – Immediate Patch Required
Microsoft released a security update for CVE‑2026‑69619, an elevation‑of‑privilege flaw in the Windows exFAT file‑system driver. The vulnerability allows local attackers to gain SYSTEM rights by manipulating exFAT volumes. All Windows 10/11 and Server 2022 installations that use exFAT are affected; apply the update via Windows Update or WSUS immediately.
Read briefing
CVE-2026-70095: Windows iSCSI Target Service Remote Code Execution
A critical RCE flaw in the Windows iSCSI Target Service allows remote attackers to execute code via crafted iSCSI requests. The issue impacts Windows Server 2019 and 2022. Defenders should apply the latest cumulative update and restrict iSCSI traffic.
Read briefing