PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability

Key Takeaways

• A proof-of-concept (PoC) exploit has been publicly released for CVE-2026-35616, a critical authentication bypass in Fortinet FortiClient EMS.
• This vulnerability, already exploited in the wild, allows unauthenticated remote attackers to access protected API endpoints.
• Affected versions include FortiClient EMS 7.4.5 and 7.4.6; the fix is available in version 7.4.7 and later.
• Organizations are urged to immediately patch vulnerable systems and restrict access to the EMS management interface.

Critical Authentication Bypass in FortiClient EMS Gains Public PoC

A proof-of-concept (PoC) exploit has been made public for CVE-2026-35616, a severe authentication and authorization bypass affecting Fortinet FortiClient Endpoint Management Server (EMS). This development provides security teams with a tool to assess their systems for exposure to the critical flaw, which Fortinet has confirmed is under active exploitation.

The Python-based tool, available on GitHub, demonstrates how an unauthenticated attacker could gain access to sensitive API endpoints within FortiClient EMS. Given the in-the-wild exploitation, immediate patching of all affected FortiClient EMS installations is paramount for organizations.

Affected Versions and Remediation

The PoC’s documentation specifies that FortiClient EMS versions 7.4.5 and 7.4.6 are vulnerable. The README within the repository also clearly states that version 7.4.7 contains the necessary security fix. The provided command-line interface allows users to target a specific host and an optional port, though the author emphasizes that testing must only be conducted on systems with explicit, written permission.

Fortinet categorizes CVE-2026-35616 as an improper access control vulnerability (CWE-284). This means a remote attacker, without valid credentials, can send specially crafted requests to bypass the authentication mechanisms of the EMS API, potentially leading to the execution of unauthorized code or commands. The severity of this flaw is amplified by the fact that EMS centrally manages FortiClient deployments, making its compromise a gateway to an organization’s entire endpoint administration infrastructure.

PoC Availability and Implications

The vulnerability impacts FortiClient EMS versions ranging from 7.4.5 through 7.4.6. Fortinet has clarified that the 7.2 branch is not affected, and cloud-based services such as FortiClient Cloud and FortiSASE have already been remediated. It is crucial for organizations to verify the exact product and version they are operating to ensure the correct application of advisories.

The GitHub repository shared by Alaatk includes a Python script along with instructions for its execution against a specified host and optional port. While this tool is invaluable for security teams validating their own systems, the public availability of exploit code also poses a risk, as it can be leveraged by malicious actors to identify and exploit vulnerable, unpatched servers.

Fortinet’s official advisory remains the primary reference for remediation. It strongly advises customers running versions 7.4.5 and 7.4.6 to apply the relevant hotfixes or upgrade to version 7.4.7 or later. Administrators must meticulously follow the instructions for their specific release and confirm the updated version post-maintenance.

What You Should Do

• Identify All FortiClient EMS Deployments: Determine if any instances are running affected versions 7.4.5 or 7.4.6.
• Apply Patches Immediately: Install the hotfix provided by Fortinet for your specific version or upgrade to FortiClient EMS 7.4.7 or later. Verify the version after patching.
• Restrict Network Access: Limit access to the EMS management interface to trusted networks only.
• Monitor for Suspicious Activity: Review logs for any unusual API requests, unexpected configuration changes, or other signs of unauthorized access.
• Perform a Compromise Assessment: If your EMS server was internet-facing and unpatched, conduct a thorough investigation for potential compromise, even after patching.
• Exercise Caution with PoC: Only run the PoC against systems for which you have explicit, written authorization, and never against external or unauthorized targets.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.