Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Public PoC Released for FortiClient EMS Flaw CVE-2026-35616

2 sources · 2 articlesFirst reported Updated ()2 · 1 read
What's new

First coverage.

Merged summary · grok-4.7-build · rewritten as coverage arrivesSummaries by Vani AI

A public proof-of-concept targets exploited FortiClient EMS flaw CVE-2026-35616, fixed in 7.4.7 or later.

A public proof-of-concept, described as Python code on GitHub, targets CVE-2026-35616, an improper-access-control flaw in Fortinet FortiClient EMS 7.4.5 and 7.4.6. An unauthenticated remote attacker can bypass EMS API protections—one report says by spoofing trusted client-certificate headers—and execute unauthorized code or commands. Fortinet rates the issue CVSS 9.1 while NVD lists 9.8. Fortinet advisory FG-IR-26-099 confirmed exploitation in the wild, with reporting placing attacks from at least March 31, 2026, and CISA added the flaw to the KEV catalog on April 6, 2026. Fortinet says 7.4.7 or later and hotfixes for the affected releases prevent exploitation; the 7.2 branch is unaffected, and FortiClient Cloud and FortiSASE were already remediated.

Key facts
  • CVE-2026-35616 is an improper-access-control flaw in Fortinet FortiClient EMS 7.4.5 and 7.4.6.
  • Fortinet rates it CVSS 9.1; NVD lists 9.8.
  • A public Python proof-of-concept was posted on GitHub.
  • Fortinet advisory FG-IR-26-099 confirmed in-the-wild exploitation, with attacks reported from at least March 31, 2026, and CISA added it to KEV on April 6, 2026.
  • Reports say an unauthenticated attacker can spoof trusted client-certificate headers, including X-SSL-CLIENT-VERIFY, and bypass EMS API protections to run unauthorized code or commands.
  • Fortinet says 7.4.7 or later and hotfixes for the affected releases prevent exploitation; the 7.2 branch is unaffected.
  • FortiClient Cloud and FortiSASE were already remediated.
Analyze CVE-2026-35616 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-35616
Vendors
Fortinet
Products
FortiClient EMSFortiClient CloudFortiSASE
Organizations
FortinetCISABishop FoxCSA Singapore

Coverage

oldest first · one row per article · UTC
  1. · 10d ago GBHackersFirst report

    PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw

    Public exploit code is out for FortiClient EMS flaw CVE-2026-35616, exploited since spring 2026.

  2. · 10d ago Cyber Security News

    PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability

    A public PoC targets critical FortiClient EMS flaw CVE-2026-35616, which Fortinet says was exploited.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-35616
Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
9.894%KEVPoC
KEV