Security teams should urgently audit FortiClient EMS deployments—or patch them—following the publication of a proof-of-concept exploit for a critical authentication and authorization bypass, tracked as CVE-2026-35616. The flaw lets unauthenticated attackers hit protected API endpoints and execute unauthorized code.
How the Vulnerability Works
Fortinet confirms that FortiClient EMS versions 7.4.5 and 7.4.6 are vulnerable. The bypass allows remote users with no valid credentials to send specially crafted requests that evade access controls on the EMS API. These weaknesses lie in how EMS handles authentication and authorization—CWE-284 classed improper access control. Fortinet assures that version 7.4.7 contains the fix. EMS versions on the 7.2 branch aren’t affected, nor are FortiClient Cloud or FortiSASE.
Proof-of-Concept Disclosed
A public PoC tool is now available on GitHub, created by researcher Alaatk. It’s a Python script with a command-line interface where operators specify a target host and optionally a port. It’s designed for defenders to verify if their EMS instances are exposed. The author cautions that testing must be done only on systems with written permission. Although no data yet shows how many organizations have been breached because of this, Fortinet reports confirmed exploitation in the wild—underlining urgency.
Mitigation & What to Do Now
Organizations running EMS 7.4.5 or 7.4.6 should install the hotfix or upgrade to version 7.4.7 or newer immediately. As part of hardening, limit access to the EMS management interface to trusted internal networks. Check logs for anomalous API requests or unexpected system changes, and inspect for signs of compromise. If your EMS server was internet-facing and unpatched, you must prioritize its review. The PoC tool is helpful for testing exposure but doesn’t replace patching or a full forensic investigation.
An inventory of all FortiClient EMS deployments in your environment is critical—ensure you know which systems are on vulnerable versions, then apply remediation and verify the updated EMS version. Always restrict testing to authorized systems only.
What This Means: FortiClient EMS is a centralized management system for Fortinet client deployments. A flaw here threatens broad endpoint security, since EMS governs policy and updates for all managed clients. If compromised, attackers could undermine defenses across multiple devices.
Proactive patching, logging, and network isolation are essential. While the PoC puts defenders on alert, organizations should avoid over-reliance on exploit code for security validation. Fixes already exist, so delay is no longer acceptable.
