CriticalZero-DayCVE-2026-35616
PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability
Cyber Security News·Source published ·1 min read
What happened?
A public proof-of-concept (PoC) for CVE-2026-35616, a critical authentication and authorization bypass in Fortinet FortiClient Endpoint Management Server (EMS), lets defenders test whether affected systems are exposed. The Python tool’s repository says the flaw can allow unauthenticated access to protected API endpoints. Fortinet has confirmed that the vulnerability was exploited in the wild, making prompt patching the priority for organizations running affected versions. The PoC is published on GitHub and names FortiClient EMS versions 7.4.5 and 7.4.6 as affected.
Key details
- A public proof-of-concept exploit for CVE-2026-35616 has been released on GitHub.
- The vulnerability allows unauthenticated remote access to protected EMS API endpoints.
- The PoC targets FortiClient EMS versions 7.4.5 and 7.4.6, with 7.4.7 containing the fix.
- The flaw is classified as improper access control (CWE-284) enabling unauthorized code execution.
- Compromise of EMS could give attackers control over central endpoint administration.
- Fortinet states the 7.2 branch is not affected and FortiClient Cloud and FortiSASE are already remediated.
Affected
- FortiClient EMS versions 7.4.5 and 7.4.6 are affected.
- The issue affects FortiClient EMS 7.4.5 through 7.4.6.
Fixes and mitigations
- Limit EMS management interface access to trusted networks.
What to look for
- Unusual API requests to the EMS management interface.
- Unexpected changes in EMS configuration or deployments.
- Signs of unauthorized activity on EMS servers.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.