CVE-2026-35616

🗓️ 04 Apr 2026 00:38:35Reported by fortinetType

cve🔗 web.nvd.nist.gov📰️ 38 Media mentions👁 502 Views🌐 WEB

FortiClientEMS versions 7.4.5 to 7.4.6 lack access control enabling unauthenticated code execution.

Reporter	Title	Published	Views	Family All 39
GithubExploit	Exploit for Improper Access Control in Fortinet Forticlientems	9 Jun 202611:16	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Fortinet Forticlientems	6 Apr 202621:04	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Fortinet Forticlientems	19 Apr 202609:46	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Fortinet Forticlientems	20 Apr 202618:08	–	githubexploit
GithubExploit	Exploit for CVE-2026-35616	6 Apr 202615:24	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Fortinet Forticlientems	31 May 202615:39	–	githubexploit
GithubExploit	Exploit for CVE-2026-35616	6 Apr 202615:16	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Fortinet Forticlientems	13 Apr 202618:49	–	githubexploit
attackerkb	CVE-2026-35616	4 Apr 202600:38	–	attackerkb
BDU FSTEC	The vulnerability of the application software interface of the Fortinet FortiClient Enterprise Management Server (EMS) allows a perpetrator to execute arbitrary commands.	6 Apr 202600:00	–	bdu_fstec

NVD

Vulners

Node

fortinet forticlientemsMatch7.4.5

fortinet forticlientemsMatch7.4.6

[
  {
    "vendor": "Fortinet",
    "product": "FortiClientEMS",
    "cpes": [
      "cpe:2.3:a:fortinet:forticlientems:7.4.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.4.5",
        "lessThanOrEqual": "7.4.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
fortiguard	www.fortiguard.fortinet.com/psirt/FG-IR-26-099
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
X-SSL-CLIENT-VERIFY	header	/api/v1/auth/signin	Pre-authentication API bypass via spoofed TLS headers enabling admin API access	CWE-284
X-SSL-CLIENT-S-DN	header	/api/v1/auth/signin	Pre-authentication API bypass via spoofed TLS headers enabling admin API access	CWE-284
X-SSL-CLIENT-SERIAL	header	/api/v1/auth/signin	Pre-authentication API bypass via spoofed TLS headers enabling admin API access	CWE-284
X-SSL-CLIENT-VERIFY	header	/api/v1/system/status	Authentication bypass on system status endpoint via forged TLS headers	CWE-284
X-SSL-CLIENT-S-DN	header	/api/v1/system/status	Authentication bypass on system status endpoint via forged TLS headers	CWE-284
X-SSL-CLIENT-SERIAL	header	/api/v1/system/status	Authentication bypass on system status endpoint via forged TLS headers	CWE-284

24 Jul 2026 21:10Current

8.5High risk

Vulners AI Score8.5

CVSS 3.19.8

EPSS0.09098

SSVC