Fortinet Confirms Wild Exploitation of EMS Bypass; Public PoC Targets Versions 7.4.5 and 7.4.6

A public proof-of-concept exploit for CVE-2026-35616 is now accessible on GitHub, lowering the barrier for attackers targeting Fortinet FortiClient Endpoint Management Server (EMS) installations. The flaw allows unauthenticated users to bypass authentication controls and access protected API endpoints, a vulnerability that Fortinet confirmed has been actively exploited in the wild since spring 2026.

What happened

The vulnerability, identified as CVE-2026-35616, stems from an improper access control issue within FortiClient EMS versions 7.4.5 and 7.4.6. According to analysis by Bishop Fox, the root cause involves a mismatch between certificate-based authentication headers and the Django application’s trust model. An attacker can spoof HTTP request headers that the backend application incorrectly interprets as valid Apache mod_ssl WSGI environment variables. This trusted-header mistake occurs behind an Apache reverse proxy that is intended to terminate mutual TLS and pass client-certificate verification results to the server.

One public repository, created by GitHub user Alaatk, provides a Python script named cve_2026_35616.py along with a README and screenshot. The tool requires the requests, urllib3, and cryptography packages, plus OpenSSL in the system PATH. Another researcher described the specific spoofed header as X-SSL-CLIENT-VERIFY. Fortinet published advisory FG-IR-26-099 on April 4, 2026, stating it had observed exploitation activity. The Register reported that the bug was believed to be under attack starting March 31, effectively functioning as a zero-day vulnerability before public disclosure.

Why it matters

Fortinet rates CVE-2026-35616 as 9.1 on the CVSS scale, while the National Vulnerability Database lists it as 9.8, classifying both ratings as critical. The primary risk is that a compromised EMS server grants administrative API access to attackers. Since EMS manages FortiClient deployments across an enterprise, this access could enable unauthorized code execution on managed endpoints. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on April 6, 2026, setting a federal remediation deadline of April 9. Later reporting indicates further exploitation activity was observed in May 2026.

Fortinet confirmed that version 7.4.7 includes the fix for this issue. The company also stated that the 7.2 branch is not affected, and that FortiClient Cloud and FortiSASE services have already been remediated. Organizations must verify their specific product versions rather than assuming all Fortinet services are vulnerable. The availability of public exploit code increases the likelihood of opportunistic scanning against internet-exposed EMS servers.

Our take on the response

• Verify inventory to identify any FortiClient EMS instances running versions 7.4.5 or 7.4.6.
• Apply the relevant hotfixes or upgrade to version 7.4.7 or later as recommended by Fortinet.
• Confirm that FortiClient Cloud or FortiSASE environments are unaffected and do not require immediate action.
• Review access logs for any signs of unauthorized API activity prior to patching.

What defenders should look for

Security teams should monitor EMS application logs for unusual authentication bypass attempts or unexpected access to administrative endpoints without valid credentials. Look for spikes in failed login attempts followed by successful API calls, which may indicate exploitation of the trust boundary. Check network traffic for anomalous HTTP headers, particularly those related to client certificate verification, originating from external sources.

If suspicious activity is detected, isolate the EMS server from the network to prevent lateral movement to managed endpoints. Investigate any new administrative sessions or configuration changes made during the window of exposure. Ensure that reverse proxy configurations are reviewed to validate header handling and trust assumptions.

Background: Lateral movement

Lateral movement is the process where an attacker navigates from one system to another within a network after initial access. They use stolen credentials or unpatched vulnerabilities to expand their reach. This tactic allows them to reach sensitive data or critical servers without triggering perimeter alarms, making internal monitoring the primary defense.

Read the full guide: Lateral Movement in Cybersecurity: Definition and Detection

What to do and how to stay safe: Fortinet

• Audit your FortiClient EMS version immediately to determine if you are running 7.4.5 or 7.4.6.
• Apply the vendor-provided hotfix or upgrade to version 7.4.7 or later to remediate the flaw.
• Review access logs for unauthenticated requests to protected API endpoints in the days before patching.
• Restrict internet exposure of EMS servers to reduce the attack surface for opportunistic scanners.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which FortiClient EMS versions are vulnerable to CVE-2026-35616?

Versions 7.4.5 and 7.4.6 are affected. Version 7.4.7 and later, as well as the 7.2 branch, are not affected.

Is there a public exploit for this vulnerability?

Yes, a Python proof-of-concept script is available on GitHub, allowing unauthenticated access to protected API endpoints.

Has this vulnerability been exploited in the wild?

Yes, Fortinet confirmed exploitation since spring 2026, and CISA added it to its Known Exploited Vulnerabilities catalog.