NCSC-2026-0296 [1.00] [M/H] Vulnerability patched in Fortinet FortiClient

unknownCVE-2026-70465

Fortinet has patched a vulnerability in FortiClient for Windows. The vulnerability concerns a classic buffer overflow in the processing of DNS response packets. This arises from a buffer copy operation without validation of input size. This allows an unauthenticated attacker to craft and send malicious DNS responses. Upon successful exploitation, the attacker can execute arbitrary code within the context of the FortiClient application.

CSIRTS triage

vendor: Fortinet product: FortiClient Remote code execution Memory corruptionaffected: Windows versions (specific versions not listed)

What: Classic buffer overflow in DNS response packet processing allows unauthenticated attackers to execute arbitrary code via crafted DNS responses.
Who is affected: FortiClient for Windows users exposed to untrusted DNS traffic.
Urgency: High urgency; remote arbitrary code execution is possible without authentication.
Action: Apply Fortinet's patch for CVE-2026-70465 to FortiClient for Windows.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FortiClient

Get an email when a new FortiClient advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-08-13
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0296

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-704650.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-70465	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Fortinet FortiClient: Vulnerability enables code executioncert-bund
unknownFortinet Products Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Fortinet products (August 13, 2026)cert-fr-avis
highCVE-2026-70465: A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fort…nvd
unknownHeap overflow in kernel driver due to missing size validationfortinet

Recent advisories for Fortinet FortiClient

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEW] [high] Fortinet FortiClient: Vulnerability enables code executioncert-bund · 2026-08-13
unknownNCSC-2026-0243 [1.00] [M/H] Vulnerability fixed in Fortinet FortiClient EMSncsc-nl · 2026-07-17
medium[NEW] [medium] Fortinet FortiClient EMS: Vulnerability allows bypassing security measurescert-bund · 2026-07-15
criticalexploitedCVE-2026-21643: Fortinet FortiClient EMS SQL Injection Vulnerabilitycisa-kev · 2026-04-13
criticalexploitedCVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerabilitycisa-kev · 2026-04-06
criticalexploitedCVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerabilitycisa-kev · 2024-03-25