The Fortinet fortimon3_74.sys kernel driver exposes an unauthenticated communication port that accepts an 8-byte message containing a magic value and a target process ID. Upon receiving this message, the driver opens the target process with PROCESS_ALL_ACCESS privileges from kernel mode, bypassing PPL protections, and terminates it without validating the caller or the target process. The driver also leaks the process handle without the OBJ_KERNEL_HANDLE flag, allowing usermode attackers to duplicate handles to protected processes like lsass.exe, potentially enabling credential theft. This vulnerability requires local administrator access and affects the FortiClient anti-exploit minifilter driver signed by Fortinet.

Local administrators can terminate any process on the system, including critical PPL-protected processes such as Windows Defender (MsMpEng.exe) and lsass.exe, potentially causing system instability or denial of service. The handle leak vulnerability may allow attackers to duplicate handles to protected processes, facilitating credential theft without terminating the process. The vulnerability does not require complex exploitation techniques and leverages excessive privileges granted by the driver.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local administrator access and monitor for unauthorized use of the vulnerable driver. Fortinet has been notified of the issue, and it is a duplicate report, indicating vendor awareness. No official patch or workaround details are provided in the available information.