Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-35616 9.8
Fortinet · FortiClient EMS · Added 2026-04-06 · Published 2026-04-04
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityFortinet FortiClient EMS Improper Access Control Vulnerability
VendorFortinet
ProductFortiClient EMS
Date added2026-04-06
Due date2026-04-09
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-284
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

NVD: A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-27 12:42 UTC
Wall time0.5s
Searches1
Component defaultyes
Sources https://github.com/keraattin/CVE-2026-35616
https://github.com/BishopFox/CVE-2026-35616-check
https://github.com/Alaatk/CVE-2026-35616
https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/
https://fortiguard.fortinet.com/psirt/FG-IR-26-099
https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-35616
https://github.com/z3r0h3ro/CVE-2026-35616-poc

Hunting hypothesis agent

Hunt EMS HTTP logs for X-SSL-CLIENT-VERIFY: SUCCESS header with URL-encoded forged PEM in X-SSL-CLIENT-CERT targeting /api/v1/fabric_device_auth endpoints; stock Apache logs omit headers so WAF capture or CustomLog %{...}i is needed.

Research details

ComponentDjango cert_chain_auth.py middleware - CertChainAuth.contains_certificate() trusts user-controllable HTTP_X_SSL_CLIENT_VERIFY header and Certificate.validate_cert_chain() performs DN string matching without cryptographic signature verification
PreconditionsThe attacker must have network reachability to the FortiClient EMS web management interface (typically TCP ports 8013 HTTP or 8443/443 HTTPS). No authentication or user interaction is required. The target must be running FortiClient EMS version 7.4.5 or 7.4.6. The attacker sends crafted HTTP requests containing spoofed headers (X-SSL-CLIENT-VERIFY: SUCCESS) and a forged client certificate PEM in the X-SSL-CLIENT-CERT header to bypass Django middleware certificate-based authentication. The middleware trusts these user-controllable HTTP headers as equivalent to Apache mod_ssl WSGI environment variables, and the certificate chain validation performs only Distinguished Name string matching with no cryptographic signature verification, allowing an attacker to forge a passing certificate chain using openssl with the correct DN strings. Successful exploitation grants full administrative API access to all managed endpoints, enabling arbitrary code execution on the EMS server and managed FortiClient endpoints. agent
DeliveryRemote unauthenticated: attacker sends HTTP requests to EMS management interface (port 8013/8443/443) with spoofed X-SSL-CLIENT-VERIFY: SUCCESS header and X-SSL-CLIENT-CERT header containing a URL-encoded self-signed PEM certificate whose subject/issuer DN strings match embedded Fortinet root CAs (e.g., CN='support' or CN='fortinet-ca2'). The cert_chain_auth.py middleware trusts the user-controllable HTTP_X_SSL_CLIENT_VERIFY header over the trusted SSL_CLIENT_VERIFY WSGI variable, and the validate_cert_chain() method performs only DN string comparison with no cryptographic signature verification, granting the attacker certificate-user role access to 16 cert_chain_approved API endpoints spanning endpoint quarantine, EMS configuration, ZTNA key management, and FortiGate device registration.
Public PoCyes
PoC URLs https://github.com/Alaatk/CVE-2026-35616
https://github.com/keraattin/CVE-2026-35616
https://github.com/BishopFox/CVE-2026-35616-check
https://github.com/z3r0h3ro/CVE-2026-35616-poc Third-party repos; verify before use.
Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-26-099
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.1). Four public PoC repos (Alaatk 37 stars, keraattin, BishopFox, z3r0h3ro). The exploit requires only two HTTP headers (X-SSL-CLIENT-VERIFY: SUCCESS and X-SSL-CLIENT-CERT with URL-encoded forged PEM) and forged certificate DN strings discoverable from any EMS installation, FortiClient agent package, or FortiGate firmware image. No authentication, user interaction, or special privileges required. Confirmed exploited in the wild since March 31, 2026 (Arctic Wolf), delivering EKZ Infostealer to managed endpoints. The hotfix strips headers at the Apache layer via RequestHeader unset directives but leaves the string-only chain validation code in cert_chain_auth.py untouched until version 7.4.7.
SummaryFortiClient EMS 7.4.5 and 7.4.6 contain an authentication bypass (CVE-2026-35616) in the Django cert_chain_auth.py middleware that allows unauthenticated attackers to gain full administrative API access. The middleware accepts certificate verification status from user-controllable HTTP headers (X-SSL-CLIENT-VERIFY) in addition to trusted Apache mod_ssl WSGI environment variables, and Apache was never configured to strip the spoofable variants. The certificate chain validation performs only Distinguished Name string matching against embedded Fortinet root CAs with no X.509 cryptographic signature verification, allowing an attacker to forge a passing certificate chain using openssl with the correct DN strings. Exploitation in the wild was confirmed by Arctic Wolf, delivering EKZ Infostealer disguised as a Fortinet patch to managed endpoints.

Tia coverage

First reported2026-05-28
First exploit report2026-05-28
Exploit report → KEV52 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

forticlient-ems-zero-day-cve-2026-35616-exploited-to-deliver-ekz

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub