VulnSocial
← Back to blog

CVE-2026-35616 – Critical Pre‑Authentication API Bypass in FortiClient EMS

Key takeaways

  • Critical CVSS 9.8 remote code execution via unauthenticated API bypass.
  • Affects FortiClient EMS 7.4.5 and 7.4.6 (versions < 7.4.7); 7.2 branch unaffected.
  • Actively exploited in the wild; added to CISA KEV on 2026‑04‑06.
  • Emergency patch released – apply immediately.

Overview

CVE-2026-35616 is a pre‑authentication API access bypass in Fortinet FortiClient Endpoint Management Server (EMS). An unauthenticated attacker can craft HTTP requests that skip all authentication and authorization checks, allowing arbitrary command execution on the management server. The flaw has been observed in active exploitation campaigns since early April 2026, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to the Known Exploited Vulnerabilities (KEV) catalog.

Technical Details

  • Vulnerability type: Improper access control ( CWE‑284 ).
  • Attack vector: Network‑accessible REST API; no credentials required.
  • Exploit mechanics: A crafted request with the HTTP header X-SSL-CLIENT-VERIFY: SUCCESS bypasses the EMS authentication layer, then executes arbitrary code via internal command‑execution endpoints.
  • Impact: Full remote code execution (RCE) – attacker can run commands with the privileges of the EMS service, potentially compromising the entire managed endpoint fleet.
  • CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Score: CVSS 9.8 (Critical).

Severity & Impact

MetricValue
SeverityCritical
CVSS9.8
CWECWE‑284
ImpactRemote code execution, full system compromise

The high‑impact vector (network‑only, no authentication) makes this vulnerability especially dangerous for any organization that relies on FortiClient EMS for endpoint management.

Affected Products

  • FortiClient EMS 7.4.5
  • FortiClient EMS 7.4.6

Versions earlier than 7.4.7 are vulnerable; the 7.2 branch is not affected. For a complete list of affected CPE entries and version ranges, see the official CVE page on VulnSocial: https://vulnsocial.com/cve/CVE-2026-35616.

Actionable Insights – What to Do Now

  1. Apply the emergency patch (FG‑IR‑26‑099) immediately on all EMS instances. Verify the installed version is 7.4.7 or later.
  2. Block known malicious IPs observed in the wild (e.g., 51.79.66.183, 94.253.208.16). Update firewall and IDS/IPS rules accordingly.
  3. Detect exploitation attempts by monitoring HTTP traffic for:
    • Requests to the EMS API lacking authentication.
    • The presence of the header X-SSL-CLIENT-VERIFY: SUCCESS from unknown sources.
  4. Enable logging and alerting on all EMS API endpoints. Correlate logs with threat‑intel feeds (e.g., VulnSocial live feed) to spot anomalous activity.
  5. Segment EMS from the rest of the network. Restrict API access to trusted management subnets and enforce TLS mutual authentication where possible.
  6. Review and harden IAM policies for any accounts that interact with EMS. Remove unnecessary privileged accounts.
  7. Plan for the scheduled patch (FortiClient EMS 7.4.7) and test it in a staging environment before production rollout.

Remediation & Mitigation

  1. Download and install the emergency patch from the vendor advisory (see References).
  2. Upgrade to FortiClient EMS 7.4.7 (or later) as soon as the scheduled release is available.
  3. Validate the remediation by confirming the EMS version via the web UI or CLI (get system status).
  4. Implement network‑level controls: allow only trusted IP ranges to reach the EMS API port (default 443).
  5. Deploy detection rules in SIEMs for the X-SSL-CLIENT-VERIFY: SUCCESS header from non‑trusted sources.
  6. If EMS is not essential, consider disabling the service until a stable version is deployed.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-099
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616

For real‑time threat intelligence, exploit activity trends, and detailed signal data, visit the VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2026-35616.

Bottom line – CVE-2026-35616 is a critical, network‑only RCE flaw in FortiClient EMS that is already being weaponized. Immediate application of the emergency patch, strict network segmentation, and active monitoring for the distinctive exploitation header are essential to prevent compromise.

#hashtags: #CVE #CVE202635616 #Critical #RCE #CISAKEV #Fortinet #FortiClientEMS