The vulnerability arises from the use of a hard‑coded cryptographic key in FortiClientEMS versions 7.4.0 through 7.4.5. This flaw allows an attacker to decrypt database dumps, potentially exposing sensitive information stored within the client database. The primary impact is the compromise of data confidentiality, as the decryption of the database would reveal user or system data that was intended to remain protected.

Affected systems include Fortinet FortiClientEMS on all impacted releases: version 7.4.0, 7.4.1, 7.4.3, 7.4.4, and 7.4.5. Users running any of these versions should verify their deployment and assess whether the local database is at risk of being exposed.

The CVSS score of 5.2 indicates a medium severity level. EPSS data is unavailable, and the vulnerability is not currently listed in the KEV catalog, implying that publicly known exploits are not recorded. Based on the description, it is inferred that the attacker would need to obtain a database dump and to use the hard‑coded key for decryption, meaning local or privileged access is likely required. Regardless, the confidentiality impact warrants prompt remediation through the recommended vendor update.