FortiClient EMS - Authentication Bypass

Exploited in the wild. Listed by CISA on 2026-04-06; known to be used by ransomware.

highseverity

94%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior.

Impact

If spoofing X-SSL-CLIENT-VERIFY changes backend behavior, Apache is likely not stripping the header before Django, indicating the target is still vulnerable.

Fix

Apply Fortinet hotfix FG-IR-26-099 or upgrade to FortiClient EMS 7.4.7+.

How to confirm it

Send: POST /api/v1/fabric_device_auth/fortigate/init
Positive when: contains(tolower(body_1), 'certificate not found') and status_code_1 == 401 && status_code_2 == 500 and (body_1 != body_2)

Run it with nuclei: nuclei -id CVE-2026-35616 -u <target>

The full check

id: CVE-2026-35616

info:
  name: FortiClient EMS - Authentication Bypass
  author: ritikchaddha
  severity: high
  description: |
    Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior.
  impact: |
    If spoofing X-SSL-CLIENT-VERIFY changes backend behavior, Apache is likely not stripping the header before Django, indicating the target is still vulnerable.
  remediation: |
    Apply Fortinet hotfix FG-IR-26-099 or upgrade to FortiClient EMS 7.4.7+.
  reference:
    - https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-35616
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35616
  classification:
    cve-id: CVE-2026-35616
    epss-score: 0.93983
    epss-percentile: 0.99848
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 2
    vendor: fortinet
    product: forticlient_ems
    shodan-query: http.favicon.hash:-800551065
  tags: cve,cve2026,fortinet,forticlient,ems,auth-bypass,kev,vkev

http:
  - raw:
      - |
        POST /api/v1/fabric_device_auth/fortigate/init HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 0

        f

      - |
        POST /api/v1/fabric_device_auth/fortigate/init HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 0
        X-SSL-CLIENT-VERIFY: SUCCESS

        f

    matchers:
      - type: dsl
        dsl:
          - "contains(tolower(body_1), 'certificate not found')"
          - "status_code_1 == 401 && status_code_2 == 500"
          - "(body_1 != body_2)"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from