CVE-2026-70465

Think of FortiClient Windows as software that reads network “instructions” (DNS messages) to make connections work. This bug happens when it accepts a specially malformed DNS message that’s too large for what it expects, which can let an attacker cause the program to run attacker-supplied code. In plain terms: a bad DNS message can be used to take control of the computer running FortiClient.

This matters to you if your business uses Fortinet FortiClientWindows on Windows machines that are running version 7.4.0–7.4.3 or 7.2.0–7.2.11. It only becomes a risk when the affected machine processes DNS responses coming from an attacker-controlled source (for example, if an attacker can influence DNS answers sent to that device). The vulnerability does not require a login or user interaction to be exploited.

This is a RED item because the flaw allows an unauthenticated attacker to get arbitrary code execution by sending malicious DNS responses over the network. Even though there are no clear public incident reports for this exact CVE, the class of bug and the ability to run code makes it something you must address now—especially on internet-exposed or attacker-influenced networks.