CVE-2026-35616: Fortinet FortiClientEMS Pre-Authentication API Bypass Leading to Remote Code Execution (CISA KEV)
CVE-2026-35616 (TL-2026-0325), also tracked as FG-IR-26-099, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-04-06. It has no confirmed attribution, affects Fortinet FortiClient Endpoint Management Server (EMS), references 1 CVE (CVE-2026-35616), maps to 14 MITRE ATT&CK techniques (T1005, T1018, T1021), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-0325
- Threat ID
- TL-2026-0325
- Also known as
- FG-IR-26-099
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-04-06
- Last reviewed
- 2026-04-06
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, healthcare, telecommunications, technology, defense, energy, education, manufacturing, critical-infrastructure
- Target regions
- North America, Europe, Asia Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 14
Critical improper access control vulnerability (CVE-2026-35616, CVSS 9.1) in Fortinet FortiClientEMS 7.4.5 through 7.4.6 allows unauthenticated remote attackers to bypass API authentication and execute arbitrary code via crafted requests. Actively exploited as a zero-day since March 31, 2026. CISA added to KEV catalog on April 6, 2026 with emergency remediation deadline of April 9, 2026.
How CVE-2026-35616 works
CVE-2026-35616 is a critical pre-authentication API access bypass vulnerability in Fortinet FortiClient Endpoint Management Server (EMS) versions 7.4.5 through 7.4.6. The vulnerability resides in the API layer of FortiClient EMS, where improper access control (CWE-284) allows unauthenticated attackers to interact with specific API endpoints without valid credentials. By sending specially crafted requests to the FortiClient EMS server interface, attackers can completely bypass the server's authentication and authorization controls, escalate privileges, and execute arbitrary code or commands on the affected system.
FortiClient EMS is the centralized management platform used by enterprises to deploy, configure, and monitor FortiClient endpoint security agents across their entire fleet. A compromise of this server provides attackers with effective god-mode capability — the ability to push malicious configurations, disable endpoint protections, execute commands at scale across all managed endpoints, and move laterally throughout the enterprise environment.
The vulnerability was discovered independently by Simo Kohonen of Defused Cyber and Nguyen Duc Anh, who observed active zero-day exploitation before responsible disclosure. watchTowr confirmed that exploitation attempts were first recorded against their honeypots on March 31, 2026. Fortinet published advisory FG-IR-26-099 and released emergency out-of-band hotfixes on April 4-5, 2026, confirming active exploitation in the wild.
CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities (KEV) catalog on April 6, 2026, ordering all Federal Civilian Executive Branch (FCEB) agencies to patch by April 9, 2026 — an unusually tight three-day remediation window reflecting the severity and active exploitation status.
This is the second critical FortiClientEMS vulnerability exploited in rapid succession. CVE-2026-21643, a pre-authentication SQL injection flaw in version 7.4.4, was disclosed in late March 2026 and is also under active exploitation. The two vulnerabilities together represent a sustained campaign targeting FortiClientEMS as a high-value enterprise entry point. Internet security watchdog Shadowserver has identified over 2,000 exposed FortiClientEMS instances online, with the majority located in the United States and Germany.
A public proof-of-concept has been identified on GitHub, though it has not been independently verified by major research firms as of publication. The combination of a public PoC, active exploitation, and the central role of EMS in enterprise endpoint management makes this an extremely high-priority patching target.
Post-exploitation capabilities include: manipulation of endpoint security policies across the entire managed fleet, deployment of malicious payloads to connected FortiClient agents, extraction of endpoint inventory data (hostnames, IPs, OS versions, serial numbers), access to ZTNA certificates and SAML configurations, creation of persistent backdoor admin accounts, and lateral movement through the broader enterprise network.
MITRE ATT&CK techniques used in TL-2026-0325
collection
discovery
T1018 Remote System Discovery; T1082 System Information Discovery
lateral-movement
T1021 Remote Services; T1210 Exploitation of Remote Services
execution
T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol
defense-evasion
persistence
initial-access
T1190 Exploit Public-Facing Application
impact
T1499 Endpoint Denial of Service
privilege-escalation
T1548 Abuse Elevation Control Mechanism
credential-access
T1555 Credentials from Password Stores
defense-impairment
Affected products and versions in CVE-2026-35616
- Fortinet — FortiClient Endpoint Management Server (EMS)
Vulnerable versions: 7.4.5; 7.4.6
Fixed in: 7.4.5 with hotfix 7.4.5.2111; 7.4.6 with hotfix 7.4.6.2170; 7.4.7 (upcoming)
Remediation for CVE-2026-35616
Patches
- FortiClientEMS 7.4.5 hotfix 7.4.5.2111
- FortiClientEMS 7.4.6 hotfix 7.4.6.2170
- FortiClientEMS 7.4.7 (upcoming permanent fix)
Immediate actions
- Apply Fortinet emergency hotfix 7.4.5.2111 for FortiClientEMS 7.4.5 instances
- Apply Fortinet emergency hotfix 7.4.6.2170 for FortiClientEMS 7.4.6 instances
- Restrict FortiClientEMS management interface access to authorized internal networks and VPNs only
- Implement firewall ACLs to block external access to EMS API endpoints
- Review API activity logs for suspicious unauthenticated requests
- Monitor for unauthorized commands or anomalous administrative behavior
Workarounds
- Restrict HTTPS access to EMS management interface to authorized management subnets only
- Deploy WAF filtering to strip or validate suspicious API request headers
- Set SITES_ENABLED=False if multi-tenancy is not in use
- Monitor FortiClientEMS.exe for spawning unexpected child processes (cmd.exe, powershell.exe)
Longer-term hardening
- Upgrade to FortiClientEMS 7.4.7 when released (permanent fix)
- Implement network segmentation isolating EMS servers from general network traffic
- Deploy WAF rules to validate and filter API requests to EMS endpoints
- Implement zero-trust security architecture for management infrastructure
- Reduce privileged and service account exposure
- Enable comprehensive logging and monitoring for all EMS administrative actions
- Conduct threat hunt for indicators of prior compromise on exposed EMS instances
CVEs associated with CVE-2026-35616
Weaknesses (CWE) in CVE-2026-35616
CWE-284
Timeline of CVE-2026-35616
- CVE-2026-21643 (related FortiClientEMS SQL injection) first observed being exploited in the wild, indicating sustained campaign against FortiClientEMS
- CVE-2026-21643 pre-authentication SQL injection in FortiClientEMS 7.4.4 publicly disclosed; active exploitation confirmed by Defused Cyber
- watchTowr honeypots record first exploitation attempts targeting CVE-2026-35616 in FortiClientEMS 7.4.5/7.4.6
- Defused Cyber (Simo Kohonen) independently observes active zero-day exploitation of CVE-2026-35616 and initiates responsible disclosure to Fortinet
- Fortinet publishes advisory FG-IR-26-099 and releases emergency out-of-band hotfixes for FortiClientEMS 7.4.5 (hotfix 7.4.5.2111) and 7.4.6 (hotfix 7.4.6.2170)
- Fortinet confirms active wild exploitation; emergency hotfixes distributed to customers. NVD publishes CVE-2026-35616 entry. BleepingComputer breaks public coverage
- Public proof-of-concept exploit code identified on GitHub (unverified by Tenable Research as of publication)
- CISA adds CVE-2026-35616 to Known Exploited Vulnerabilities catalog; orders FCEB agencies to remediate by April 9, 2026. Shadowserver reports 2,000+ exposed instances globally
- CISA KEV remediation deadline for FCEB agencies — all federal FortiClientEMS instances must be patched or mitigated
- As of 2026-05-29, CVE-2026-35616 remains actively exploited despite Fortinet's April hotfixes and CISA KEV listing. Arctic Wolf, Help Net Security and BleepingComputer report a fresh May 2026 campaign abusing the auth bypass to push EKZ Infostealer as a fake FortiEndpoint_Patch.exe to managed endpoints.
Sources cited for CVE-2026-35616
- Fortinet PSIRT Advisory FG-IR-26-099
- NVD - CVE-2026-35616
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-35616
- Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS - The Hacker News
- New FortiClient EMS flaw exploited in attacks, emergency patch released - BleepingComputer
- CISA orders feds to patch Fortinet flaw exploited in attacks by Friday - BleepingComputer
- CVE-2026-35616 Fortinet FortiClientEMS zero-day exploited - Tenable
- FortiClient EMS zero-day exploited, emergency hotfixes available - Help Net Security
- FortiClient EMS Vulnerability Detection - runZero
- Critical FortiClient EMS Vulnerability CVE-2026-35616 Defense Guide - Security Arsenal
- CVE-2026-21643 Pre-Authentication SQL Injection in FortiClient EMS - Bishop Fox
- Fortinet Rushes Emergency Patch After Zero-Day - Cyber Kendra
- 2,000+ FortiClient EMS Instances Exposed Online - Shadowserver Data
Threats related to CVE-2026-35616
Detection coverage for TL-2026-0325
As of 2026-04-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0325 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.