Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to vulnerabilities
Medium

Hardcoded Encryption Key Exposes Saved VPN Passwords in FortiClientWindows

IdentifiersCVE-2026-44278CWE-798

CVE-2026-44278 is a use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows affecting version 7.4.0 through 7.4.2 and all versions in the 7.2 branch. The available content indicates that FortiClientWindows uses a hardcoded encryption key in connection with VPN saved passwords, which can allow information disclosure. Based on the provided description and mention context, the issue is specifically tied to protection of locally stored VPN credentials, where the confidentiality of saved passwords depends on a key embedded in the product rather than a unique, per-user or per-installation secret.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can disclose saved VPN passwords from affected FortiClientWindows installations. Exposure of these credentials can enable unauthorized access to VPN services and any downstream internal resources reachable through those accounts, depending on the privileges associated with the compromised credentials. The provided content characterizes the issue as information disclosure and notes a CVSS score of 2.1.

Mitigation

If you can’t patch tonight, do this now.

Until patched versions are deployed, reduce exposure by disabling the practice of storing VPN passwords in FortiClientWindows where operationally feasible, enforcing MFA on VPN access, and rotating credentials that may have been stored on affected systems. Limit local access to endpoints, monitor for unauthorized VPN use, and treat saved VPN credentials on affected clients as potentially recoverable by an attacker with sufficient access to the host or stored credential material. Specific vendor-provided temporary mitigations are not available in the provided content.

Remediation

Patch, then assume compromise.

Upgrade FortiClientWindows to a fixed release outside the affected ranges. The affected versions identified in the provided content are 7.4.0 through 7.4.2 and all 7.2 versions. Organizations should follow Fortinet's vendor guidance for the specific patched version once available in the relevant advisory or release notes. After remediation, review whether VPN credentials were stored on affected endpoints and rotate any potentially exposed VPN passwords.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
FortinetForticlientapplication
FortinetForticlientwindowsapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2026-44278
NVD
nvd.nist.gov/vuln/detail/CVE-2026-44278
MITRE CWE · CWE-798
cwe.mitre.org
Vendor Advisory
fortiguard.fortinet.com/psirt/FG-IR-26-129