FortiClient EMS Pre-Authentication API Bypass Leading to RCE (CVE-2026-35616) — Active Zero-Day Exploitation
FortiClient EMS Pre-Authentication API Bypass Leading to RCE (TL-2026-0324), also tracked as FG-IR-26-099, is a critical-severity zero-day vulnerability scored CVSS 9.8, first published 2026-04-06. It has no confirmed attribution, affects Fortinet FortiClient Endpoint Management Server (EMS), references 1 CVE (CVE-2026-35616), maps to 14 MITRE ATT&CK techniques (T1003, T1021, T1046), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-0324
- Threat ID
- TL-2026-0324
- Also known as
- FG-IR-26-099
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- ZERO_DAY
- First published
- 2026-04-06
- Last reviewed
- 2026-04-06
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, healthcare, technology, education, energy, defense, telecommunications, manufacturing
- Target regions
- North America, Europe, Asia Pacific
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in FortiClient EMS Pre-Authentication API Bypass Leading to RCE
Malware and tooling: AnyDesk, ScreenConnect
Critical pre-authentication API access control bypass (CVE-2026-35616) in Fortinet FortiClient EMS 7.4.5 and 7.4.6 allows unauthenticated attackers to execute arbitrary code via crafted API requests. Actively exploited as a zero-day since March 31, 2026, with over 2,000 exposed instances identified globally by Shadowserver.
How FortiClient EMS Pre-Authentication API Bypass Leading to RCE works
CVE-2026-35616 is a critical improper access control vulnerability (CWE-284) in Fortinet FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. The flaw resides in the API authentication and authorization layer, enabling unauthenticated remote attackers to completely bypass access controls and execute arbitrary code or commands by sending specially crafted API requests to the management interface.
FortiClient EMS is a centralized endpoint management platform used by organizations to deploy, configure, and monitor FortiClient security agents across their enterprise endpoints. The EMS server manages security policies, software updates, and compliance enforcement for all connected FortiClient agents. Compromising the EMS server gives attackers a privileged position inside the network with trust relationships to all managed endpoints.
The vulnerability requires no authentication, no user interaction, and no elevated privileges to exploit. The attack complexity is low — a single crafted API request to the management interface (typically exposed on ports 443 for HTTPS management and 8013 for telemetry) is sufficient to achieve code execution. The CVSS v3.1 base score is 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Fortinet's temporal score with environmental factors is 9.1.
Active exploitation was first recorded by watchTowr against their honeypot infrastructure on March 31, 2026 — four days before Fortinet published the advisory. Defused Cyber independently observed zero-day exploitation using their Radar real-time exploitation detection system. The exploitation campaign was ongoing before public disclosure, indicating advanced threat actor awareness of the vulnerability.
This vulnerability arrives merely days after CVE-2026-21643 (CVSS 9.8), another critical pre-authentication flaw in FortiClient EMS (SQL injection via the /api/v1/init_consts endpoint through the Site header), came under active exploitation. The proximity and similar target surface raise the possibility that the same threat actors may be chaining both vulnerabilities or pivoting between them. CVE-2026-21643 affects version 7.4.4 and was fixed in 7.4.5 — ironically, the same version that introduced CVE-2026-35616.
Post-exploitation patterns observed in prior FortiClient EMS compromise campaigns (CVE-2023-48788) provide a reliable template for expected attacker behavior: deployment of remote management tools (ScreenConnect, AnyDesk, Splashtop, Atera), credential harvesting with mimikatz, lateral movement via SMB/PsExec/WMI/RDP, network reconnaissance with tools like Advanced Port Scanner and Nmap, and data exfiltration to cloud storage services. Given the similar attack surface and value proposition, defenders should expect analogous post-exploitation tradecraft.
The Shadowserver Foundation has fingerprinted approximately 2,000 FortiClient EMS instances exposed to the public internet, with the highest concentrations in the United States and Germany. Organizations with internet-exposed EMS deployments are at immediate risk and should apply the emergency hotfixes without delay.
Fortinet has released emergency hotfixes (7.4.5.2111 and 7.4.6.2170) for the affected versions, with a permanent fix expected in FortiClient EMS 7.4.7. The FortiClient EMS 7.2.x branch is not affected and requires no action.
MITRE ATT&CK techniques used in TL-2026-0324
credential-access
T1003 OS Credential Dumping; T1110 Brute Force
lateral-movement
discovery
T1046 Network Service Discovery; T1082 System Information Discovery
execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
defense-evasion
initial-access
T1190 Exploit Public-Facing Application
exfiltration
T1567 Exfiltration Over Web Service
defense-impairment
Affected products and versions in FortiClient EMS Pre-Authentication API Bypass Leading to RCE
- Fortinet — FortiClient Endpoint Management Server (EMS)
Vulnerable versions: 7.4.5; 7.4.6
Fixed in: 7.4.5 hotfix 7.4.5.2111; 7.4.6 hotfix 7.4.6.2170; 7.4.7 (upcoming)
Remediation for FortiClient EMS Pre-Authentication API Bypass Leading to RCE
Patches
- FortiClient EMS 7.4.5 hotfix 7.4.5.2111
- FortiClient EMS 7.4.6 hotfix 7.4.6.2170
- FortiClient EMS 7.4.7 (upcoming permanent fix)
Immediate actions
- Apply emergency hotfix 7.4.5.2111 for FortiClient EMS 7.4.5 installations immediately
- Apply emergency hotfix 7.4.6.2170 for FortiClient EMS 7.4.6 installations immediately
- Restrict external network access to EMS management interfaces (ports 443 and 8013)
- Audit EMS API logs for unauthorized unauthenticated requests indicating prior compromise
- Review FortiClient EMS access logs for anomalous API authentication bypass attempts
- Check for indicators of post-exploitation: unexpected remote access tools (ScreenConnect, AnyDesk), new admin accounts, credential harvesting tools
Workarounds
- Block external access to FortiClient EMS management interface (ports 443 and 8013) via firewall rules
- Restrict API access to trusted internal IP ranges only
- Consider temporarily disabling internet-facing EMS access until patches are applied
- Monitor for exploitation attempts using web server access logs and IDS/IPS signatures
Longer-term hardening
- Upgrade to FortiClient EMS 7.4.7 when released for the permanent fix
- Implement network segmentation to isolate EMS management plane from general network traffic
- Deploy web application firewall (WAF) rules to filter malicious API requests to EMS endpoints
- Enable enhanced logging and SIEM integration for FortiClient EMS API activity
- Conduct forensic review of EMS servers that were exposed prior to patching
- Establish vulnerability management SLA for Fortinet products given recurring critical vulnerabilities
CVEs associated with FortiClient EMS Pre-Authentication API Bypass Leading to RCE
Weaknesses (CWE) in FortiClient EMS Pre-Authentication API Bypass Leading to RCE
CWE-284
Timeline of FortiClient EMS Pre-Authentication API Bypass Leading to RCE
- Fortinet releases FortiClient EMS 7.4.5 and 7.4.6, containing the vulnerable API access control code
- CVE-2026-21643 (SQL injection in FortiClient EMS 7.4.4) confirmed under active exploitation, signaling heightened threat actor interest in FortiClient EMS attack surface
- watchTowr records first exploitation attempts against CVE-2026-35616 on their honeypot infrastructure, confirming active zero-day exploitation
- Defused Cyber observes zero-day exploitation of CVE-2026-35616 in the wild using their Radar real-time exploitation detection system
- Shadowserver Foundation identifies approximately 2,000 FortiClient EMS instances exposed to the public internet, with highest concentrations in USA and Germany
- Fortinet publishes PSIRT advisory FG-IR-26-099 and releases emergency hotfixes (7.4.5.2111 and 7.4.6.2170) for affected FortiClient EMS versions
- Fortinet officially confirms active exploitation in the wild and urges all customers to apply emergency hotfixes immediately
- Major security outlets (BleepingComputer, The Hacker News, Help Net Security) publish detailed reports on CVE-2026-35616 active exploitation
- As of 2026-05-29, CVE-2026-35616 (FortiClient EMS pre-auth API bypass RCE, CVSS 9.1, CISA KEV) remains actively exploited — Arctic Wolf, BleepingComputer and Help Net Security reported a fresh May 28-29 campaign abusing it to push the new EKZ infostealer as a fake Fortinet patch. Only hotfixes exist; permanent fix 7.4.7 is still unreleased, so this is a live concern.
Sources cited for FortiClient EMS Pre-Authentication API Bypass Leading to RCE
- Fortinet PSIRT Advisory FG-IR-26-099
- BleepingComputer — New FortiClient EMS flaw exploited in attacks
- The Hacker News — Fortinet Patches Actively Exploited CVE-2026-35616
- Help Net Security — FortiClient EMS zero-day exploited
- Cyber Kendra — Fortinet Rushes Emergency Patch After Zero-Day
- SecurityOnline — Critical 9.1 CVSS FortiClient EMS Flaw Exploited
- CybersecurityNews — 2,000+ FortiClient EMS Instances Exposed
- runZero — Fortinet FortiClient EMS vulnerability: CVE-2026-35616
- Heise — FortiClient EMS: Critical code-injection vulnerability exploited
- SecurityAffairs — CVE-2026-35616: Fortinet fixes actively exploited flaw
- Darktrace — FortiClient EMS Exploited: Attack Chain & Post Exploitation
- Kaspersky Securelist — FortiClient EMS Vulnerability Exploited in the Wild
- Fortinet Documentation — Required Services and Ports (EMS 7.4.5)
Threats related to FortiClient EMS Pre-Authentication API Bypass Leading to RCE
Detection coverage for TL-2026-0324
As of 2026-04-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0324 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.