PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability

A public proof-of-concept (PoC) for CVE-2026-35616, a critical authentication and authorization bypass in Fortinet FortiClient Endpoint Management Server (EMS), lets defenders test whether affected systems are exposed.

The flaw can allow unauthenticated access to protected API endpoints. Fortinet has confirmed that the vulnerability was exploited in the wild, making prompt patching the priority for organizations running affected versions.

The PoC is published by Alaatk on GitHub and names FortiClient EMS versions 7.4.5 and 7.4.6 as affected. Its README identifies version 7.4.7 as containing the fix.

It provides a command-line interface that accepts a target and optional port. The author warns that testing must be limited to systems covered by explicit written permission.

Fortinet classifies CVE-2026-35616 as improper access control, or CWE-284. In practical terms, a remote user without valid credentials may send crafted requests that bypass protections on the EMS API and execute unauthorized code or commands.

The risk is serious because EMS manages FortiClient deployments so that a compromise could give an attacker access to a central endpoint-administration system.

PoC Released for FortiClient EMS Vulnerability

The issue affects FortiClient EMS 7.4.5 through 7.4.6. Fortinet says the 7.2 branch is not affected, and that FortiClient Cloud and FortiSASE have already been remediated. Organizations should confirm the exact product and version they operate rather than applying the advisory to every Fortinet service.

The GitHub repository shared by Alaatk includes a Python script and instructions for running it against a specified host, with an optional port. That makes the code relevant to security teams validating their own systems.

However, public exploit code can also help unauthorized users test exposed servers. The repository does not indicate how many systems are vulnerable or confirm whether any organization has been compromised.

Fortinet’s advisory is the key remediation reference. It urges customers on versions 7.4.5 and 7.4.6 to install the relevant hotfixes. It says the fix is included in version 7.4.7 or later. Administrators should follow the instructions for their exact release and verify the resulting version after maintenance.

Organizations should also limit access to the EMS management interface to trusted networks, review available logs for unusual API requests or unexpected changes, and investigate signs of unauthorized activity.

If the server was reachable from the internet while unpatched, teams should prioritize reviewing it. A PoC test can confirm exposure, but it should not replace patching or a broader compromise check.

The most important step is to identify all FortiClient EMS deployments and determine whether any run 7.4.5 or 7.4.6. Apply the vendor hotfix or upgrade to 7.4.7 or later, then confirm the change. Do not run the PoC against systems outside the organization or without written authorization.

For additional context, see CybersecurityNews’ coverage of the FortiClient EMS zero-day and emergency hotfix and its report on exposed FortiClient EMS instances. The official Fortinet PSIRT advisory and the CVE-2026-35616 PoC repository provide the primary technical and remediation references.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.