CVE-2026-35616

9.8

CRITICAL CVSS 3.1

Fortinet FortiClient EMS Improper Access Control Vulnerability - [Actively Exploited]

Overview

Description

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Details

INFO

Published Date :

April 4, 2026, 1:16 a.m.

Last Modified :

April 6, 2026, 6:12 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Apr 09, 2026

Alert Date: Apr 06, 2026 | 23 days ago

Description :

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-099 ; https://nvd.nist.gov/vuln/detail/CVE-2026-35616

Impact

Affected Products

The following products are affected by CVE-2026-35616 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Fortinet	forticlientems

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				6abe59d8-c742-4dff-8ce8-9b0ca1073da8
	CVSS 3.1	CRITICAL				[email protected]

Solution

Update FortiClientEMS to a version that addresses the improper access control vulnerability.

Update FortiClientEMS to the latest available version.
Apply vendor patches or security advisories.
Restrict access to the affected service.
Monitor for unauthorized activity.

Public PoC/Exploit Available at Github

CVE-2026-35616 has a 16 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-35616.

URL	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-099	Vendor Advisory Patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-35616 is associated with the following CWEs:

CWE-284: Improper Access Control

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-35616 weaknesses.

CAPEC-19: Embedding Scripts within Scripts Embedding Scripts within Scripts CAPEC-441: Malicious Logic Insertion Malicious Logic Insertion CAPEC-478: Modification of Windows Service Configuration Modification of Windows Service Configuration CAPEC-479: Malicious Root Certificate Malicious Root Certificate CAPEC-502: Intent Spoof Intent Spoof CAPEC-503: WebView Exposure WebView Exposure CAPEC-536: Data Injected During Configuration Data Injected During Configuration CAPEC-546: Incomplete Data Deletion in a Multi-Tenant Environment Incomplete Data Deletion in a Multi-Tenant Environment CAPEC-550: Install New Service Install New Service CAPEC-551: Modify Existing Service Modify Existing Service CAPEC-552: Install Rootkit Install Rootkit CAPEC-556: Replace File Extension Handlers Replace File Extension Handlers CAPEC-558: Replace Trusted Executable Replace Trusted Executable CAPEC-562: Modify Shared File Modify Shared File CAPEC-563: Add Malicious File to Shared Webroot Add Malicious File to Shared Webroot CAPEC-564: Run Software at Logon Run Software at Logon CAPEC-578: Disable Security Software Disable Security Software

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

rael-ivar/caladan-security-advisories

Security advisories published by Caladan Security Studio

Updated: 6 days, 4 hours ago

0 stars 0 fork 0 watcher

Born at : April 23, 2026, 5:16 p.m. This repo has been linked 1 different CVEs too.

Kalijith7/remediation-prioritization-engine

None

Python

Updated: 3 days, 16 hours ago

0 stars 0 fork 0 watcher

Born at : April 21, 2026, 10:21 a.m. This repo has been linked 5 different CVEs too.

wa6n3r/CVE-2026-35616

None

Python

Updated: 1 week, 2 days ago

0 stars 1 fork 1 watcher

Born at : April 20, 2026, 6:08 p.m. This repo has been linked 1 different CVEs too.

endiselmanaj/macos-vuln-check

macOS vulnerability check script - detects 23 recent supply chain attacks and CVEs (Jan-Apr 2026)

Shell

Updated: 1 week, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 20, 2026, 3:45 p.m. This repo has been linked 10 different CVEs too.

IAwiz87/cisa-kev-browser

Standalone offline browser for the CISA Known Exploited Vulnerabilities (KEV) catalog. No server, no install — open in any browser.

Python HTML

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : April 20, 2026, 2:15 p.m. This repo has been linked 3 different CVEs too.

Alaatk/CVE-2026-35616

Fortinet FortiClientEMS improper access control

Python

Updated: 1 week ago

4 stars 1 fork 1 watcher

Born at : April 19, 2026, 9:46 a.m. This repo has been linked 1 different CVEs too.

keraattin/CVE-2026-35616

CVE-2026-35616 - FortiClient EMS Pre-Authentication API Bypass (CVSS 9.1, CISA KEV). Python & Nmap NSE detection scripts with full technical breakdown. One forged HTTP header bypasses authentication on FortiClient EMS 7.4.5–7.4.6, granting full admin API access to all managed endpoints.

authentication-bypass cybersecurity forticlient fortinet nmap-scripts nse-scripts vulnerability-detection vulnerability-research cve-2026-35616 forticlient-ems

Python Lua

Updated: 2 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 13, 2026, 6:49 p.m. This repo has been linked 1 different CVEs too.

jeetpatel5767/Scraper

None

JavaScript HTML CSS

Updated: 2 weeks, 4 days ago

0 stars 0 fork 0 watcher

Born at : April 11, 2026, 5:38 a.m. This repo has been linked 1 different CVEs too.

packet-noir/kev_rec

Retrieves CVEs added in the last N days from CISA's Known Exploited Vulnerability (KEV) database.

Python

Updated: 1 week, 5 days ago

0 stars 0 fork 0 watcher

Born at : April 8, 2026, 1:52 a.m. This repo has been linked 3 different CVEs too.

BishopFox/CVE-2026-35616-check

None

Python

Updated: 3 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 6, 2026, 9:04 p.m. This repo has been linked 1 different CVEs too.

fevar54/forticlient_ems_cve_2026_35616_poc.py

None

Python

Updated: 3 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 6, 2026, 3:24 p.m. This repo has been linked 1 different CVEs too.

fevar54/CVE-2026-35616-detector.py

This tool detects if a FortiClient EMS server is vulnerable to **CVE-2026-35616**, a critical improper access control vulnerability affecting versions **7.4.5 through 7.4.6**.

Python

Updated: 3 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 6, 2026, 3:16 p.m. This repo has been linked 1 different CVEs too.

z3r0h3ro/CVE-2026-35616-poc

None

Updated: 2 weeks, 6 days ago

2 stars 0 fork 0 watcher

Born at : April 4, 2026, 4:06 p.m. This repo has been linked 1 different CVEs too.

0xBlackash/CVE-2026-35616

CVE-2026-35616

Python

Updated: 3 weeks, 4 days ago

0 stars 0 fork 0 watcher

Born at : April 4, 2026, 8:43 a.m. This repo has been linked 1 different CVEs too.

myseq/tracker

Security Tracker

Python

Updated: 4 days, 22 hours ago

0 stars 0 fork 0 watcher

Born at : April 3, 2026, 11 a.m. This repo has been linked 10 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-35616 vulnerability anywhere in the article.

The Hacker News

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

Threat actors are exploiting security flaws in TBK DVR and end‑of‑life (EoL) TP-Link Wi-Fi routers to deploy Mirai-botnet variants on compromised devices, according to findings from Fortinet FortiGuar ...

Published Date: Apr 18, 2026 (1 week, 4 days ago)

The Hacker News

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

Huntress is warning that threat actors are exploiting three recently disclosed security flaws in Microsoft Defender to gain elevated privileges in compromised systems. The activity involves the exploi ...

Published Date: Apr 17, 2026 (1 week, 5 days ago)

The Hacker News

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA). To tha ...

Published Date: Apr 17, 2026 (1 week, 5 days ago)

The Hacker News

ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories

You know that feeling when you open your feed on a Thursday morning and it's just... a lot? Yeah. This week delivered. We've got hackers getting creative in ways that are almost impressive if you igno ...

Published Date: Apr 16, 2026 (1 week, 6 days ago)

The Hacker News

Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution

Cisco has announced patches to address four critical security flaws impacting Identity Services and Webex Services that could result in arbitrary code execution and allow an attacker to impersonate an ...

Published Date: Apr 16, 2026 (1 week, 6 days ago)

The Register

Patch these critical Fortinet sandbox bugs that let attackers bypass login, run commands over HTTP

Watch out for more Fortinet vulns! Two critical bugs in Fortinet's sandbox could allow unauthenticated attackers to bypass authentication or execute unauthorized code on vulnerable systems. Luckily, t ...