CVE-2026-35616 Fortinet FortiClientEMS zero-day exploited in the wild

CVE-2026-35616 Fortinet FortiClientEMS zero-day exploited

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

This Fortinet FortiClientEMS vulnerability has been exploited in the wild. A hotfix is available and should be applied as soon as possible to protect from this threat.

According to its banner, the version of Fortinet Forticlient EMS running on the remote host is 7.4.5 prior to 7.4.7. It is, therefore, affected by an Improper Access Control that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Fortinet FortiClient EMS installed on the remote host is 7.4.5 or 7.4.6. It is, therefore, affected by an authentication bypass vulnerability:

  - An improper access control vulnerability [CWE-284] in FortiClient EMS may allow an unauthenticated attacker to     execute unauthorized code or commands via crafted requests. Fortinet has observed this vulnerability to be exploited     in the wild. (CVE-2026-35616)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Fortinet FortiClient EMS instance running on the remote host is vulnerable to CVE-2026-35616, a reverse proxy header trust vulnerability. The CertChainAuth middleware blindly trusts the X-SSL-CLIENT-VERIFY and X-SSL-CLIENT-CERT headers without validating that they originated from the legitimate reverse proxy.

An unauthenticated attacker who can reach the EMS HTTPS port directly can inject X-SSL-CLIENT-VERIFY: SUCCESS along with a client certificate to bypass the mutual TLS authentication gate and access CertChainAuth-protected API endpoints.

ID	Name	Product	Family	Severity
115213	Fortinet Forticlient EMS 7.4.5 < 7.4.7 Improper Access Control	Web App Scanning	Component Vulnerability	critical
305855	Fortinet FortiClient EMS 7.4.5 / 7.4.6 API Authentication Bypass (FG-IR-26-099)	Nessus	Misc.	critical
305155	FortiClient EMS 7.4.x Reverse Proxy Header Spoofing Auth Bypass (CVE-2026-35616)	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-35616

critical

Tenable Plugins

critical

critical

critical