PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw
Public exploit code is out for FortiClient EMS flaw CVE-2026-35616, exploited since spring 2026.
A public Python proof-of-concept is available for CVE-2026-35616, an improper-access-control vulnerability in FortiClient EMS 7.4.5 through 7.4.6. Fortinet rates it CVSS 9.1 and NVD lists 9.8; an unauthenticated attacker can spoof trusted client-certificate headers and execute unauthorized code or commands. Fortinet advisory FG-IR-26-099 said exploitation had been observed, reporting placed attacks from at least March 31, 2026, and CISA added the flaw to KEV on April 6. Fortinet says version 7.4.7 or later and hotfixes for the affected releases fully prevent exploitation.
- A public Python PoC targets pre-authentication bypass CVE-2026-35616.
- Attackers can spoof trusted client-certificate headers, including X-SSL-CLIENT-VERIFY.
- It was exploited as a zero-day and added to CISA KEV on April 6, 2026.
- Fortinet says 7.4.7 or later and hotfixes fully prevent exploitation.
- CVEs
- CVE-2026-35616
- Vendors
- Fortinet
- Organizations
- FortinetCISABishop FoxCSA Singapore
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35616 | Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6 | 9.8 | 94% | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
A public proof-of-concept (PoC) exploit is now available for CVE-2026-35616, a critical authentication bypass in Fortinet FortiClient Endpoint Management Server (EMS). The flaw has been exploited in the wild since spring 2026. FortiClient EMS authentication bypass According to details published by GitHub user Alaatk, a repository titled “CVE-2026-35616 FortiClient EMS Pre-Auth Bypass” contains a Python […]
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.