EIP-2026-117176

PRE-CVE

FortiClient SSLVPN 5.4 - Credentials Disclosure

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-117176. PoCs published by Viktor Minin.

AI-analyzed exploit summary This exploit extracts cleartext credentials from FortiClient SSLVPN's process memory by scanning for specific patterns. It leverages the WinAppDbg library to dump and parse memory regions containing sensitive data.

Description

FortiClient SSLVPN 5.4 - Credentials Disclosure

Exploits (1)

exploitdb WORKING POC
by Viktor Minin · pythonlocalwindows
https://www.exploit-db.com/exploits/40330

This exploit extracts cleartext credentials from FortiClient SSLVPN's process memory by scanning for specific patterns. It leverages the WinAppDbg library to dump and parse memory regions containing sensitive data.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: FortiClient SSLVPN <=5.4
No auth needed
Prerequisites: Local access to the target system · FortiTray.exe process running
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026