PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw

A public proof-of-concept (PoC) exploit is now available for CVE-2026-35616, a critical authentication bypass in Fortinet FortiClient Endpoint Management Server (EMS). The flaw has been exploited in the wild since spring 2026.

FortiClient EMS authentication bypass

According to details published by GitHub user Alaatk, a repository titled “CVE-2026-35616 FortiClient EMS Pre-Auth Bypass” contains a Python script (cve_2026_35616.py), a README and a screenshot.

The README says the script gives unauthenticated access to protected API endpoints. At the time of writing, the repository had 40 stars and 11 forks.

The script needs the requests, urllib3 and cryptography packages, plus OpenSSL in the system PATH. Usage is python3 cve_2026_35616.py [port]. The README says the tool is for authorized testing only.

The repository’s claim that the exploit works has not been independently validated. The README gives no success rate and does not show that the script achieves every impact Fortinet describes.

CVE-2026-35616 is an improper access control flaw (CWE-284) in FortiClient EMS 7.4.5 through 7.4.6. An unauthenticated attacker can send crafted requests to execute unauthorized code or commands. Fortinet rates it 9.1 on CVSS, while NVD lists 9.8 (Critical).

Bishop Fox’s analysis traces the root cause to certificate-based authentication. An attacker can spoof HTTP request headers that the Django application trusts as equivalent to Apache mod_ssl WSGI environment variables.

A separate public repository names the spoofed header as X-SSL-CLIENT-VERIFY. Another researcher describes this as a trusted-header mistake behind an Apache reverse proxy. That proxy is meant to terminate mutual TLS and pass the client-certificate verification result to the backend.

Attribute	Detail
CVE	CVE-2026-35616
Advisory	FG-IR-26-099
Affected	FortiClient EMS 7.4.5–7.4.6
Not affected	FortiClient EMS 7.2
Fixed	7.4.7 or later
CVSS	9.1 (Fortinet) / 9.8 (NVD)
Attack vector	Network, no authentication, no user interaction

Fortinet published advisory FG-IR-26-099 on April 4, 2026, and said it had observed exploitation. The Register reported the bug was believed to be under attack since at least March 31 and was used as a zero-day.

CISA added it to the Known Exploited Vulnerabilities catalog on April 6, with a federal remediation deadline of April 9. Later reporting also describes further exploitation activity observed in May 2026.

Public exploit code lowers the barrier for less skilled attackers. Opportunistic scanning of internet-exposed EMS servers is likely to rise.

A compromised EMS server could give attackers administrative API access. That access could lead to code execution on managed endpoints across the enterprise.

Fortinet advises upgrading to FortiClient EMS 7.4.7 or later. It also supplies hotfixes for 7.4.5 and 7.4.6, which it says fully prevent exploitation. FortiClient Cloud and FortiSASE were remediated by Fortinet, so customers need to take no action.

Recommended steps include patching or hotfixing every EMS 7.4.5 and 7.4.6 server immediately, removing EMS management interfaces from direct internet exposure and restricting access to trusted networks, reviewing web and API logs for unusual requests, especially spoofed client-certificate headers, going back to March 31, 2026, checking EMS servers and managed endpoints for unexpected commands, new admin accounts or unauthorized software deployments, and treating any unpatched, internet-facing server as potentially compromised and starting incident response.

The CSA Singapore advisory also warns that successful exploitation could fully compromise the EMS server.

This article runs about 500 words. I didn’t find hashes or network indicators in the sources, so I left out an IOC table.