PoC Code Released for Fortinet FortiClient EMS Authentication Bypass CVE-2026-35616
Public exploit code for a critical Fortinet FortiClient EMS flaw is now available online, lowering the barrier for attackers to target unpatched servers.
Key points
- A Python-based proof-of-concept exploit for CVE-2026-35616 has been published on GitHub, allowing unauthenticated access to protected API endpoints.
- The critical authentication bypass flaw affects FortiClient EMS versions 7.4.5 through 7.4.6 and has been exploited in the wild since spring 2026.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on April 6, 2026, setting a federal remediation deadline of April 9.
A public proof-of-concept exploit for CVE-2026-35616 is now available for download, posing a heightened risk to organizations running vulnerable versions of Fortinet FortiClient Endpoint Management Server. This release follows months of confirmed wild exploitation of the critical authentication bypass flaw, which allows attackers to bypass security controls without valid credentials.
According to GBHackers, the exploit code was published in a GitHub repository by user Alaatk. The repository contains a Python script named cve_2026_35616.py, along with a README file and a screenshot demonstrating the tool’s functionality. At the time of the report, the repository had accumulated 40 stars and 11 forks, indicating growing interest from the security community and potential threat actors.
Context and Background
The vulnerability, rated 9.1 on CVSS by Fortinet and 9.8 by the National Vulnerability Database, stems from an improper access control flaw in FortiClient EMS versions 7.4.5 through 7.4.6. Bishop Fox analysis indicates the root cause lies in how the Django application handles certificate-based authentication. Attackers can spoof HTTP request headers that the application mistakenly trusts as equivalent to Apache mod_ssl WSGI environment variables.
One public repository identifies the spoofed header as X-SSL-CLIENT-VERIFY. Another researcher describes the issue as a trusted-header mistake behind an Apache reverse proxy. This proxy is designed to terminate mutual TLS connections and pass the client-certificate verification result to the backend application, but the flaw allows attackers to bypass this verification step.
Fortinet published advisory FG-IR-26-099 on April 4, 2026, confirming it had observed exploitation of the vulnerability. According to The Register, the bug was believed to be under attack since at least March 31, 2026, and was initially used as a zero-day vulnerability. Later reporting also described further exploitation activity observed in May 2026, suggesting persistent targeting of affected systems.
Who Is Affected
Organizations using FortiClient EMS versions 7.4.5 and 7.4.6 are directly affected by this vulnerability. The flaw allows unauthenticated attackers to send crafted requests to execute unauthorized code or commands on the server. A compromised EMS server could give attackers administrative API access, which may lead to code execution on managed endpoints across the enterprise.
The availability of public exploit code lowers the barrier for less skilled attackers. Opportunistic scanning of internet-exposed EMS servers is likely to rise as threat actors utilize the readily available tools. That suggests organizations with exposed EMS instances face an immediate and escalating risk of unauthorized access.
What should you do?
Organizations should immediately verify if they are running affected versions of FortiClient EMS. Network administrators should monitor for unusual traffic patterns or unauthorized access attempts to EMS servers. Security teams should review logs for signs of exploitation, particularly focusing on HTTP requests that may indicate header spoofing attempts.
What to do and how to stay safe: Fortinet
- Check your FortiClient EMS version to determine if you are running 7.4.5 or 7.4.6, which are the affected versions.
- Monitor network traffic for unauthorized access attempts to your EMS servers, especially from untrusted sources.
- Review server logs for signs of header spoofing or unusual API requests that may indicate exploitation.
- Once the vendor provides an update, apply the patch immediately to remediate the authentication bypass vulnerability.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-35616?
CVE-2026-35616 is a critical authentication bypass vulnerability in Fortinet FortiClient EMS versions 7.4.5 through 7.4.6 that allows unauthenticated attackers to execute unauthorized code.
When was the PoC exploit released?
The public proof-of-concept exploit was recently released on GitHub, following months of confirmed wild exploitation since spring 2026.
Which versions of FortiClient EMS are affected?
FortiClient EMS versions 7.4.5 and 7.4.6 are affected by this vulnerability, which stems from an improper access control flaw.
