Local privilege escalation via symlinked temp files

Insecure temporary file handling in FortiClient for Windows 6.2.1 and earlier allows local users to gain elevated privileges via a symlink attack. The client exhausts predictable temporary-file names, then follows an attacker-created symbolic link when creating a privileged file. A local user account is required, and successful exploitation can compromise confidentiality, integrity, and availability through elevated privileges.