Fortinet EMS Bypass Threatens Enterprise Endpoint Control via CVE-2026-35616

Organisations relying on Fortinet FortiClient Endpoint Management Server face immediate operational risk from CVE-2026-35616, a critical authentication bypass that grants unauthenticated attackers access to protected API endpoints. The vulnerability affects versions 7.4.5 and 7.4.6, allowing malicious actors to execute unauthorized code or commands without valid credentials. This exposure threatens the integrity of central endpoint-administration systems across enterprises.

The risk

The flaw stems from improper access control in certificate-based authentication mechanisms, according to analysis by Bishop Fox. Attackers can spoof HTTP request headers that the Django application trusts as equivalent to Apache mod_ssl WSGI environment variables. A separate public repository identifies the spoofed header as X-SSL-CLIENT-VERIFY, describing the issue as a trusted-header mistake behind an Apache reverse proxy meant to terminate mutual TLS.

Who is exposed

Fortinet states that FortiClient EMS versions 7.4.5 through 7.4.6 are affected by this vulnerability. The vendor confirmed that the 7.2 branch is not impacted, and that FortiClient Cloud and FortiSASE have already been remediated. Organizations must verify their specific product versions rather than assuming all Fortinet services are vulnerable to this specific authentication bypass flaw.

Cost and compliance

CISA added CVE-2026-35616 to its Known Exploited Vulnerabilities catalog on April 6, 2026, setting a federal remediation deadline of April 9. Fortinet published advisory FG-IR-26-099 on April 4, confirming observed exploitation. The Register reported the bug was under attack since at least March 31, functioning as a zero-day vulnerability before public disclosure.

What happens next

Administrators should immediately verify if they operate affected EMS versions and apply the relevant hotfixes provided by Fortinet. The vendor indicates that version 7.4.7 includes the fix for this authentication bypass. Teams must confirm the exact release installed and verify the version after maintenance to ensure the vulnerability is fully resolved.

Questions to ask your suppliers

Leaders should ask managed service providers whether they monitor for unauthorized API access attempts on endpoint management systems. Determine if your supplier has verified that all FortiClient EMS instances are patched to version 7.4.7 or later. Confirm whether incident response plans include procedures for compromised endpoint administration servers. Ensure your security team can detect lateral movement from a breached management console to managed endpoints.

What to do and how to stay safe: Fortinet

• Audit your inventory to identify any instances of FortiClient EMS versions 7.4.5 or 7.4.6 currently in operation.
• Apply the vendor-provided hotfixes or upgrade to version 7.4.7 or later as soon as possible to close the authentication bypass.
• Monitor network logs for unusual API traffic or unauthorized access attempts targeting your endpoint management server.
• Review firewall rules to restrict external access to EMS administrative interfaces, limiting exposure to trusted networks only.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Fortinet products are affected by CVE-2026-35616?

FortiClient EMS versions 7.4.5 and 7.4.6 are affected. The 7.2 branch, FortiClient Cloud, and FortiSASE are not impacted.

Has this vulnerability been exploited in the wild?

Yes, Fortinet confirmed exploitation since spring 2026, with CISA adding it to its Known Exploited Vulnerabilities catalog in April 2026.

Is there a public exploit available for this flaw?

Yes, a Python proof-of-concept script is available on GitHub, allowing unauthenticated access to protected API endpoints.