# FortiClient EMS Pre-Authentication API Bypass Leading to RCE (CVE-2026-35616) — Active Zero-Day Exploitation

> Critical pre-authentication API access control bypass (CVE-2026-35616) in Fortinet FortiClient EMS 7.4.5 and 7.4.6 allows unauthenticated attackers to execute arbitrary code via crafted API requests. Actively exploited as a zero-day since March 31, 2026, with over 2,000 exposed instances identified globally by Shadowserver.

- **Published:** 2026-04-06T12:00:00Z
- **Last reviewed:** 2026-04-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0324
- **ID:** TL-2026-0324
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35616

## Description

CVE-2026-35616 is a critical improper access control vulnerability (CWE-284) in Fortinet FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. The flaw resides in the API authentication and authorization layer, enabling unauthenticated remote attackers to completely bypass access controls and execute arbitrary code or commands by sending specially crafted API requests to the management interface.

FortiClient EMS is a centralized endpoint management platform used by organizations to deploy, configure, and monitor FortiClient security agents across their enterprise endpoints. The EMS server manages security policies, software updates, and compliance enforcement for all connected FortiClient agents. Compromising the EMS server gives attackers a privileged position inside the network with trust relationships to all managed endpoints.

The vulnerability requires no authentication, no user interaction, and no elevated privileges to exploit. The attack complexity is low — a single crafted API request to the management interface (typically exposed on ports 443 for HTTPS management and 8013 for telemetry) is sufficient to achieve code execution. The CVSS v3.1 base score is 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Fortinet's temporal score with environmental factors is 9.1.

Active exploitation was first recorded by watchTowr against their honeypot infrastructure on March 31, 2026 — four days before Fortinet published the advisory. Defused Cyber independently observed zero-day exploitation using their Radar real-time exploitation detection system. The exploitation campaign was ongoing before public disclosure, indicating advanced threat actor awareness of the vulnerability.

This vulnerability arrives merely days after CVE-2026-21643 (CVSS 9.8), another critical pre-authentication flaw in FortiClient EMS (SQL injection via the /api/v1/init_consts endpoint through the Site header), came under active exploitation. The proximity and similar target surface raise the possibility that the same threat actors may be chaining both vulnerabilities or pivoting between them. CVE-2026-21643 affects version 7.4.4 and was fixed in 7.4.5 — ironically, the same version that introduced CVE-2026-35616.

Post-exploitation patterns observed in prior FortiClient EMS compromise campaigns (CVE-2023-48788) provide a reliable template for expected attacker behavior: deployment of remote management tools (ScreenConnect, AnyDesk, Splashtop, Atera), credential harvesting with mimikatz, lateral movement via SMB/PsExec/WMI/RDP, network reconnaissance with tools like Advanced Port Scanner and Nmap, and data exfiltration to cloud storage services. Given the similar attack surface and value proposition, defenders should expect analogous post-exploitation tradecraft.

The Shadowserver Foundation has fingerprinted approximately 2,000 FortiClient EMS instances exposed to the public internet, with the highest concentrations in the United States and Germany. Organizations with internet-exposed EMS deployments are at immediate risk and should apply the emergency hotfixes without delay.

Fortinet has released emergency hotfixes (7.4.5.2111 and 7.4.6.2170) for the affected versions, with a permanent fix expected in FortiClient EMS 7.4.7. The FortiClient EMS 7.2.x branch is not affected and requires no action.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service

## Sources

- [Fortinet PSIRT Advisory FG-IR-26-099](https://fortiguard.fortinet.com/psirt/FG-IR-26-099)
- [BleepingComputer — New FortiClient EMS flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/new-fortinet-forticlient-ems-flaw-cve-2026-35616-exploited-in-attacks/)
- [The Hacker News — Fortinet Patches Actively Exploited CVE-2026-35616](https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html)
- [Help Net Security — FortiClient EMS zero-day exploited](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/)
- [Cyber Kendra — Fortinet Rushes Emergency Patch After Zero-Day](https://www.cyberkendra.com/2026/04/fortinet-rushes-emergency-patch-after.html)
- [SecurityOnline — Critical 9.1 CVSS FortiClient EMS Flaw Exploited](https://securityonline.info/forticlient-ems-vulnerability-exploited-in-the-wild-cve-2026-35616/)
- [CybersecurityNews — 2,000+ FortiClient EMS Instances Exposed](https://cybersecuritynews.com/forticlient-ems-instances-exposed-online/)
- [runZero — Fortinet FortiClient EMS vulnerability: CVE-2026-35616](https://www.runzero.com/blog/fortinet-forticlient-ems/)
- [Heise — FortiClient EMS: Critical code-injection vulnerability exploited](https://www.heise.de/en/news/FortiClient-EMS-Critical-code-injection-vulnerability-is-being-exploited-11246026.html)
- [SecurityAffairs — CVE-2026-35616: Fortinet fixes actively exploited flaw](https://securityaffairs.com/190392/hacking/cve-2026-35616-fortinet-fixes-actively-exploited-high-severity-flaw.html)
- [Darktrace — FortiClient EMS Exploited: Attack Chain & Post Exploitation](https://www.darktrace.com/blog/forticlient-ems-exploited-inside-the-attack-chain-and-post-exploitation-tactics)
- [Kaspersky Securelist — FortiClient EMS Vulnerability Exploited in the Wild](https://securelist.com/patched-forticlient-ems-vulnerability-exploited-in-the-wild/115046/)
- [Fortinet Documentation — Required Services and Ports (EMS 7.4.5)](https://docs.fortinet.com/document/forticlient/7.4.5/ems-administration-guide/439480/required-services-and-ports)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0324