The vulnerability arises from the use of a hard‑coded cryptographic key in Fortinet FortiClientWindows versions 7.4.0 through 7.4.2 and all 7.2 releases. Attackers could potentially exploit this weakness to read data protected by the hardened key, thereby exposing confidential information. This flaw maps to CWE‑321, which represents weak or predictable cryptographic keys.

FortiClientWindows from Fortinet, specifically the 7.4.0‑7.4.2 releases and every 7.2.x series. Systems running any of these versions are vulnerable.

The CVSS score is 2.1, indicating a low risk level, and no EPSS figure is currently available. The vulnerability is not listed in the CISA KEV catalog. The official description does not state an attack vector, so the exact method of exploitation is not known. However, the presence of a hard‑coded key suggests that if an attacker can read application configuration or memory, information disclosure could be achieved.