CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability
Description
CVE-2026-35616 is a CRITICAL improper access control vulnerability in Fortinet FortiClient EMS, carrying a CVSS 3.1 score of 9.1. The vulnerability allows unauthenticated attackers to bypass pre-authentication API access controls, leading to privilege escalation and remote code execution through crafted HTTP requests. FortiClient EMS versions 7.4.5 and 7.4.6 are affected. Exploitation was detected in the wild as early as March 31, 2026, by watchTowr, several days before Fortinet published its advisory on April 4, 2026. Over 2,000 exposed FortiClient EMS instances have been identified on the internet, with the largest concentrations in the United States and Germany. CISA added CVE-2026-35616 to the KEV catalog on April 6, 2026, with a remediation deadline of April 9, 2026. The vulnerability was discovered independently by Simo Kohonen of Defused Cyber and Nguyen Duc Anh. A hotfix is available, with a full fix in version 7.4.7. The EPSS score of 0.060 (6.0%) indicates growing but not yet widespread exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | forticlientems | 7.4.5; 7.4.6 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-099(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616(US Government Resource)
Weakness Type
Improper Access Control
Improper Access Control is a vulnerability class where software fails to properly restrict access to resources or functionality. This includes missing authentication checks, flawed authorization logic, and insufficient validation of access permissions. When access controls are improperly implemented, attackers can bypass authentication requirements, escalate privileges, and access functionality or data that should be restricted to authorized users only.
In CVE-2026-35616, FortiClient EMS fails to enforce proper authentication and access controls on certain API endpoints. An unauthenticated attacker can send crafted requests to these endpoints, bypassing the pre-authentication access control mechanisms entirely. This grants the attacker access to privileged API functions that should require authentication, ultimately enabling remote code execution on the FortiClient EMS server. Since FortiClient EMS is the centralized management platform for FortiClient endpoint agents, compromising it provides an attacker with the ability to control endpoint security policies, deploy software to managed endpoints, and access sensitive configuration data across the entire managed endpoint fleet.
Impact Analysis
CVE-2026-35616 carries a CVSS 3.1 score of 9.1 (CRITICAL), reflecting the severe consequences of unauthenticated access to the FortiClient EMS management platform.
Confidentiality (High): Successful exploitation provides access to the FortiClient EMS management console, which contains endpoint inventory data, security policy configurations, VPN connection profiles, endpoint compliance status, and potentially cached credentials. The attacker gains visibility into the organization's entire managed endpoint fleet and its security posture.
Integrity (High): With administrative access to FortiClient EMS, an attacker can modify endpoint security policies, disable security features on managed endpoints, deploy malicious software packages through the legitimate management channel, alter VPN configurations, and tamper with compliance reporting. The trust relationship between FortiClient EMS and managed endpoints provides a direct path for lateral movement.
Availability (High): Attackers can disrupt endpoint management operations by modifying or deleting policies, disconnecting managed endpoints, or disabling the EMS service itself. The code execution capability also enables denial of service through resource exhaustion or system manipulation.
Exploitation Context: The combination of unauthenticated access, over 2,000 internet-exposed instances, and pre-advisory exploitation detection indicates a rapidly developing threat. The three-day KEV remediation deadline reflects CISA's assessment of the immediate risk. Organizations in the United States and Germany are particularly exposed given the geographic distribution of vulnerable instances.
Exploit Maturity
Active Exploitation: CVE-2026-35616 is confirmed to be actively exploited in the wild. CISA added it to the KEV catalog on April 6, 2026, with a remediation deadline of April 9, 2026. Exploitation activity was first detected by watchTowr on March 31, 2026, predating Fortinet's official advisory on April 4, 2026, indicating the vulnerability was exploited as a zero-day before a patch was available.
Pre-Advisory Exploitation Window: The gap between observed exploitation (March 31) and vendor advisory (April 4) represents a critical window during which attackers could operate without defenders having official guidance or patches. Organizations should investigate their FortiClient EMS logs for this time period to identify potential compromise.
Attack Surface: Internet scanning has identified over 2,000 FortiClient EMS instances directly exposed to the internet, primarily in the United States and Germany. These instances are immediately vulnerable to unauthenticated exploitation. The relatively narrow set of affected versions (7.4.5 and 7.4.6) focuses the attack surface but also means recently upgraded environments are disproportionately affected.
EPSS Context: The EPSS score of 0.060 (6.0%) reflects the early stage of exploitation activity. Given the confirmed active exploitation and the high number of exposed instances, this score is expected to increase significantly as exploitation scales.
Ransomware Association: The CISA KEV catalog entry should be checked for ransomware associations. FortiClient EMS servers represent high-value targets for ransomware operators due to their role in endpoint management, which can be leveraged for mass deployment of ransomware to managed endpoints.
Remediation
-
Apply the hotfix or upgrade to FortiClient EMS 7.4.7 immediately. Fortinet has released a hotfix for affected versions (7.4.5 and 7.4.6) and a complete fix in version 7.4.7. Prioritize upgrading to 7.4.7 for the permanent fix. If immediate upgrading is not feasible, apply the hotfix as an interim measure. Consult Fortinet's security advisory (FG-IR-2026-XXX) for specific upgrade instructions.
-
Restrict network access to FortiClient EMS management interfaces. Ensure that the EMS management console and API endpoints are not directly exposed to the internet. Place FortiClient EMS behind a VPN or restrict access to trusted management networks only. Review firewall rules to block unauthorized access to EMS ports (typically TCP 443 and TCP 8013).
-
Investigate for indicators of compromise. Review FortiClient EMS logs for unusual API requests, especially unauthenticated access attempts to privileged endpoints, during the period from March 31, 2026 onward. Check for unauthorized configuration changes, unexpected software deployments to managed endpoints, new administrative accounts, and anomalous network connections from the EMS server.
-
Rotate credentials associated with FortiClient EMS. If compromise is suspected or cannot be ruled out, rotate all credentials stored in or accessible to FortiClient EMS, including administrative accounts, LDAP/AD service accounts, VPN pre-shared keys, and certificates used for endpoint communication.
-
Verify managed endpoint integrity. Check that no unauthorized policies, software packages, or configuration changes were pushed to managed FortiClient endpoints. Review deployment logs and compare current endpoint configurations against known-good baselines.
-
Implement enhanced monitoring. Deploy network detection rules for exploitation attempts targeting FortiClient EMS. Enable detailed logging on the EMS server and forward logs to a SIEM for real-time analysis. Monitor for indicators of compromise published by security researchers and Fortinet.
Technical Details
CVE-2026-35616 is a CRITICAL improper access control vulnerability in Fortinet FortiClient EMS versions 7.4.5 and 7.4.6 that enables unauthenticated remote code execution.
CVSS 3.1 Vector Analysis: The CVSS score of 9.1 reflects Attack Vector (Network), Attack Complexity (Low), Privileges Required (None), and User Interaction (None). The unauthenticated, network-accessible nature of the vulnerability with low attack complexity makes exploitation straightforward for any attacker who can reach the FortiClient EMS management interface.
Vulnerability Mechanism: FortiClient EMS exposes API endpoints for management operations including endpoint provisioning, policy deployment, and administrative functions. In affected versions (7.4.5 and 7.4.6), certain API endpoints lack proper pre-authentication access control checks. An attacker can craft HTTP requests that bypass the authentication layer entirely, gaining access to privileged API functions without providing valid credentials. This access control bypass can be leveraged to execute arbitrary code on the FortiClient EMS server.
Attack Prerequisites: The attacker requires network access to the FortiClient EMS management interface. No authentication, valid credentials, or user interaction are needed. The attack can be fully automated and does not require specialized tools or techniques beyond the ability to craft HTTP requests.
Affected Architecture: FortiClient EMS serves as the centralized management server for FortiClient endpoint agents. It manages endpoint security policies, VPN configurations, software deployment, and compliance monitoring. The EMS server maintains persistent connections with managed FortiClient agents, creating a trust relationship that can be abused if the EMS server is compromised.
Version Specificity: Only FortiClient EMS versions 7.4.5 and 7.4.6 are affected, suggesting the vulnerability was introduced in a recent update to the access control logic. Earlier versions (7.4.4 and below) and the patched version (7.4.7) are not affected. This narrow version scope is unusual and may indicate a regression introduced during development.
Frequently Asked Questions
What is CVE-2026-35616?
CVE-2026-35616 is a critical improper access control vulnerability in Fortinet FortiClient EMS versions 7.4.5 and 7.4.6 that allows unauthenticated attackers to bypass API access controls and execute code remotely. It is being actively exploited in the wild and was added to CISA's KEV catalog on April 6, 2026.
Which FortiClient EMS versions are affected?
Only FortiClient EMS versions 7.4.5 and 7.4.6 are affected. Version 7.4.4 and earlier are not vulnerable. Fortinet has released version 7.4.7 with a permanent fix, and a hotfix is available for the affected versions.
Was this exploited before a patch was available?
Yes. Exploitation was detected by watchTowr on March 31, 2026, four days before Fortinet published its advisory on April 4, 2026. This pre-advisory exploitation window means organizations running affected versions may have been compromised before patches were available. Forensic investigation of FortiClient EMS logs during this period is strongly recommended.
How many FortiClient EMS instances are exposed?
Internet scanning has identified over 2,000 FortiClient EMS instances directly accessible from the internet, with the largest concentrations in the United States and Germany. Organizations should verify whether their FortiClient EMS management interfaces are unintentionally exposed and restrict access to trusted networks.
What is the risk if my FortiClient EMS is compromised?
A compromised FortiClient EMS server gives attackers control over the entire managed endpoint fleet. They can modify security policies, deploy malicious software to all managed endpoints, access VPN configurations and credentials, and use the management infrastructure as a pivot point for lateral movement. The centralized nature of EMS makes it a high-value target with cascading impact across the organization.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.