Fortinet PPL bypass
Source Reddit ExploitDev
Rated by Threat Radar
Data as of 10 Sep 2026, 16:51 UTC
What to do
AI-suggested
Until a fix is available, restrict local administrator access and monitor for unauthorized use of the vulnerable driver. Fortinet has been notified of the issue, and it is a duplicate report, indicating vendor awareness.
Discussion
A vulnerability in Fortinet's fortimon3_74.sys kernel driver allows any local administrator to terminate protected processes, including Windows Defender and lsass.exe, by sending an 8-byte message to an unauthenticated communication port. This bypasses Protected Process Light (PPL) protections without requiring complex exploitation techniques. Additionally, a handle leak issue may enable credential theft by duplicating a handle to a protected process. The vulnerability requires local administrator privileges and affects the FortiClient anti-exploit minifilter driver.
r/ExploitDev (opens in a new tab)u/nanaynunay0 points0 comments
hi, this is my repo, support pls https://github.com/mein-0/forti-research