GitHub PoC enables remote code execution in FortiClient EMS 7.4.5-7.4.6 via CVE-2026-35616

A public proof-of-concept exploit is now available for CVE-2026-35616, a critical authentication bypass in Fortinet FortiClient Endpoint Management Server. The vulnerability affects versions 7.4.5 through 7.4.6 and has been actively exploited in the wild since spring 2026.

What happened

GitHub user Alaatk published a repository containing a Python script designed to exploit the authentication bypass in FortiClient EMS. According to GBHackers, the README says the script gives unauthenticated access to protected API endpoints. The repository includes usage instructions and a screenshot.

Bishop Fox analysis indicates the root cause lies in certificate-based authentication mechanisms. An attacker can spoof HTTP request headers that the Django application trusts as equivalent to Apache mod_ssl WSGI environment variables. This mistake allows the backend to accept spoofed verification results from the Apache reverse proxy.

Fortinet published advisory FG-IR-26-099 on April 4, 2026, confirming observed exploitation of the flaw. The Register reported that the bug was believed to be under attack since at least March 31, serving as a zero-day vulnerability before detection. CISA added the issue to its Known Exploited Vulnerabilities catalog on April 6, setting a federal remediation deadline of April 9.

Why it matters

Fortinet rates CVE-2026-35616 as 9.1 on the CVSS scale, while the NVD lists it at 9.8, classifying it as critical. The vulnerability is an improper access control flaw, identified as CWE-284, allowing unauthenticated attackers to send crafted requests. Successful exploitation can lead to unauthorized code or command execution on the management server.

A compromised EMS server could give attackers administrative API access to the management console. That access could lead to code execution on managed endpoints across the entire enterprise network. Public exploit code lowers the barrier for less skilled attackers to target these systems.

Opportunistic scanning of internet-exposed EMS servers is likely to rise following the release of the proof-of-concept code. Later reporting describes further exploitation activity observed in May 2026, indicating sustained attacker interest in this vulnerability. The lack of independent validation for the repository’s claims does not diminish the risk of automated scanning.

What to watch

• Monitor network logs for unusual connections to FortiClient EMS ports.
• Look for unauthorized API calls or new administrative accounts created on the server.
• Check for outbound traffic from EMS servers that does not match normal management patterns.
• Review authentication logs for failed attempts followed by successful unauthenticated access.

Who needs to act first

Teams should prioritize updating internet-facing FortiClient EMS instances immediately, as these are the most exposed to opportunistic scanning. Internal systems should follow shortly after, ensuring a consistent security posture across the environment. Before deploying any updates, verify compatibility with existing endpoint configurations to avoid service disruption. Back up current server states to allow for quick rollback if issues arise. Isolate compromised servers from the network to prevent lateral movement while investigations proceed.

Background: APIs

APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.

Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches

What to do and how to stay safe: Fortinet

• Verify if your FortiClient EMS servers are running versions 7.4.5 or 7.4.6.
• Apply the latest security updates provided by Fortinet to remediate the vulnerability.
• Restrict network access to EMS servers to trusted IP addresses only.
• Monitor for signs of compromise, such as unexpected administrative changes or new endpoints.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What versions of FortiClient EMS are affected by CVE-2026-35616?

Fortinet FortiClient EMS versions 7.4.5 through 7.4.6 are affected by this vulnerability.

Is there a fix available for this authentication bypass?

Fortinet has published an advisory and observed exploitation, implying updates are available, but specific patch versions are not detailed in the source material.

How did attackers exploit this vulnerability before the patch?

Attackers used the flaw as a zero-day, exploiting it since at least March 31, 2026, by spoofing HTTP headers to bypass authentication.