Fortinet FortiClient (Windows) 7.2.x / 7.4.x < 7.4.8 Arbitrary Process Termination (FG-IR-26-165)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346901);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-84386");
  script_xref(name:"IAVA", value:"2026-A-0996");

  script_name(english:"Fortinet FortiClient (Windows) 7.2.x / 7.4.x < 7.4.8 Arbitrary Process Termination (FG-IR-26-165)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by an unverified ownership vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of FortiClient installed on the remote Windows host is 7.2.x or 7.4.x prior to 7.4.8. It is, therefore,
affected by a vulnerability as referenced in the FG-IR-26-165 advisory.

  - An unverified ownership vulnerability [CWE-283] in the FortiClient Windows fortimon3 driver may allow an
    authenticated attacker to terminate arbitrary processes via an exposed minifilter communication port. This
    affects FortiClientWindows 7.4.0 through 7.4.7 and FortiClientWindows 7.2 all versions.
    (CVE-2026-84386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://fortiguard.fortinet.com/psirt/FG-IR-26-165");
  script_set_attribute(attribute:"solution", value:
"Upgrade to FortiClient (Windows) version 7.4.8 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:N/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84386");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:fortinet:forticlient");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("forticlient_detect.nbin");
  script_require_keys("installed_sw/FortiClient");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'FortiClient', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version' : '7.2.0', 'max_version' : '7.2.999999', 'fixed_display' : '7.4.8 or above (no fix for the 7.2.x branch)' },
        { 'min_version' : '7.4.0', 'fixed_version' : '7.4.8' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);