# CVE-2026-35616: Fortinet FortiClientEMS Pre-Authentication API Bypass Leading to Remote Code Execution (CISA KEV)

> Critical improper access control vulnerability (CVE-2026-35616, CVSS 9.1) in Fortinet FortiClientEMS 7.4.5 through 7.4.6 allows unauthenticated remote attackers to bypass API authentication and execute arbitrary code via crafted requests. Actively exploited as a zero-day since March 31, 2026. CISA added to KEV catalog on April 6, 2026 with emergency remediation deadline of April 9, 2026.

- **Published:** 2026-04-06T12:00:00Z
- **Last reviewed:** 2026-04-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0325
- **ID:** TL-2026-0325
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35616, CVE-2026-21643

## Description

CVE-2026-35616 is a critical pre-authentication API access bypass vulnerability in Fortinet FortiClient Endpoint Management Server (EMS) versions 7.4.5 through 7.4.6. The vulnerability resides in the API layer of FortiClient EMS, where improper access control (CWE-284) allows unauthenticated attackers to interact with specific API endpoints without valid credentials. By sending specially crafted requests to the FortiClient EMS server interface, attackers can completely bypass the server's authentication and authorization controls, escalate privileges, and execute arbitrary code or commands on the affected system.

FortiClient EMS is the centralized management platform used by enterprises to deploy, configure, and monitor FortiClient endpoint security agents across their entire fleet. A compromise of this server provides attackers with effective god-mode capability — the ability to push malicious configurations, disable endpoint protections, execute commands at scale across all managed endpoints, and move laterally throughout the enterprise environment.

The vulnerability was discovered independently by Simo Kohonen of Defused Cyber and Nguyen Duc Anh, who observed active zero-day exploitation before responsible disclosure. watchTowr confirmed that exploitation attempts were first recorded against their honeypots on March 31, 2026. Fortinet published advisory FG-IR-26-099 and released emergency out-of-band hotfixes on April 4-5, 2026, confirming active exploitation in the wild.

CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities (KEV) catalog on April 6, 2026, ordering all Federal Civilian Executive Branch (FCEB) agencies to patch by April 9, 2026 — an unusually tight three-day remediation window reflecting the severity and active exploitation status.

This is the second critical FortiClientEMS vulnerability exploited in rapid succession. CVE-2026-21643, a pre-authentication SQL injection flaw in version 7.4.4, was disclosed in late March 2026 and is also under active exploitation. The two vulnerabilities together represent a sustained campaign targeting FortiClientEMS as a high-value enterprise entry point. Internet security watchdog Shadowserver has identified over 2,000 exposed FortiClientEMS instances online, with the majority located in the United States and Germany.

A public proof-of-concept has been identified on GitHub, though it has not been independently verified by major research firms as of publication. The combination of a public PoC, active exploitation, and the central role of EMS in enterprise endpoint management makes this an extremely high-priority patching target.

Post-exploitation capabilities include: manipulation of endpoint security policies across the entire managed fleet, deployment of malicious payloads to connected FortiClient agents, extraction of endpoint inventory data (hostnames, IPs, OS versions, serial numbers), access to ZTNA certificates and SAML configurations, creation of persistent backdoor admin accounts, and lateral movement through the broader enterprise network.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1548 Abuse Elevation Control Mechanism
- T1078 Valid Accounts
- T1136 Create Account
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1499 Endpoint Denial of Service

## Sources

- [Fortinet PSIRT Advisory FG-IR-26-099](https://fortiguard.fortinet.com/psirt/FG-IR-26-099)
- [NVD - CVE-2026-35616](https://nvd.nist.gov/vuln/detail/CVE-2026-35616)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-35616](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS - The Hacker News](https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html)
- [New FortiClient EMS flaw exploited in attacks, emergency patch released - BleepingComputer](https://www.bleepingcomputer.com/news/security/new-fortinet-forticlient-ems-flaw-cve-2026-35616-exploited-in-attacks/)
- [CISA orders feds to patch Fortinet flaw exploited in attacks by Friday - BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-fortinet-flaw-exploited-in-attacks-by-friday/)
- [CVE-2026-35616 Fortinet FortiClientEMS zero-day exploited - Tenable](https://www.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the)
- [FortiClient EMS zero-day exploited, emergency hotfixes available - Help Net Security](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/)
- [FortiClient EMS Vulnerability Detection - runZero](https://www.runzero.com/blog/fortinet-forticlient-ems/)
- [Critical FortiClient EMS Vulnerability CVE-2026-35616 Defense Guide - Security Arsenal](https://securityarsenal.com/blog/critical-forticlient-ems-vulnerability-cve-2026-35616-immediate-defense-and-patching-guide)
- [CVE-2026-21643 Pre-Authentication SQL Injection in FortiClient EMS - Bishop Fox](https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4)
- [Fortinet Rushes Emergency Patch After Zero-Day - Cyber Kendra](https://www.cyberkendra.com/2026/04/fortinet-rushes-emergency-patch-after.html)
- [2,000+ FortiClient EMS Instances Exposed Online - Shadowserver Data](https://cybersecuritynews.com/forticlient-ems-instances-exposed-online/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0325