🚨 CVE-2026-35616 - FortiClient EMS Authentication Bypass 🚨

Improper Access Control | Pre-Auth API Bypass
Exploited in the Wild — April 2026

📋 Overview

CVE-2026-35616 is a critical vulnerability in FortiClient Enterprise Management Server (EMS) versions 7.4.5 through 7.4.6.

An unauthenticated remote attacker can send specially crafted requests to bypass authentication and authorization checks, potentially leading to unauthorized code execution or full server compromise.

Fortinet Advisory: FG-IR-26-099

🛠️ Repository Contents

⚠️ Important Warning

This repository is for defensive and research purposes only.

• Use only in isolated lab environments or on systems you own and are authorized to test.
• The vulnerability is actively exploited in the wild.
• Do not use these tools for unauthorized scanning or offensive activities.

🚨 Vulnerability Details

• CVE ID: CVE-2026-35616
• Severity: Critical (CVSS 9.1)
• Affected Versions: FortiClient EMS 7.4.5 - 7.4.6
• Vulnerability Type: Improper Access Control (CWE-284)
• Impact: Authentication & Authorization Bypass (Pre-Auth)
• Exploited in the Wild: Yes (Confirmed by Fortinet)

🛡️ Mitigation & Remediation

Immediate Actions:

1. Isolate the server from the internet immediately
2. Apply the official Fortinet Hotfix for 7.4.5 / 7.4.6
3. Upgrade to 7.4.7 or newer when available
4. Restrict access to EMS via VPN only (never expose directly to internet)

📌 How to Use

1. Using Nuclei Template

nuclei -t CVE-2026-35616.yaml -u https://your-ems-server:8443

2. Using Python Detector

python3 check_safe_CVE-2026-35616.py https://your-ems-server:8443

🔍 Detection Screenshots

📄 References

• Fortinet PSIRT - FG-IR-26-099
• NVD - CVE-2026-35616
• FortiClient EMS Documentation

⭐ Disclaimer

This project is maintained for educational and defensive security purposes.
The author is not responsible for any misuse of the provided detection tools.

Stay safe. Patch early. Patch often.