Summary
| Vulnerability Name | FortiClient EMS Authentication Bypass (CVE-2026-35616) |
| Released on | April 21, 2026 |
| Affected Component | FortiClient Endpoint Management Server (FortiClient EMS) |
| Affected Version | 7.4.5 ≤ FortiClient EMS ≤ 7.4.6 |
| Vulnerability Type | Authentication bypass |
| Exploitation Condition | 1. User authentication: not required. 2. Preconditions: default configurations. 3. Trigger mode: remote. |
| Impact | Exploitation difficulty: easy. Unauthorized attackers can exploit this vulnerability to disclose sensitive information. Severity: critical. This vulnerability may lead to information disclosure. |
| Official Solution | Available |
About the Vulnerability
Component Introduction
FortiClient EMS is an enterprise-level management server software. It assists enterprises in managing and monitoring FortiClient endpoints, including security policies, software updates, remote access, etc. FortiClient EMS offers a centralized management platform that enables enterprises to more efficiently manage and safeguard their network security. In addition, the software provides real-time monitoring and reporting capabilities, which can help enterprises identify and resolve network security issues at the earliest opportunity.
Vulnerability Description
On April 21, 2026, Sangfor FarSight Labs received notification of the authentication bypass vulnerability in FortiClient EMS (CVE-2026-35616), classified as critical in threat level.
Specifically, FortiClient EMS contains a vulnerability that allows API authentication and authorization bypass. Attackers can send specially crafted requests to the target server, and exploit authentication flaws in the internal microservice routing and communication mechanisms of FortiClient EMS to bypass frontend authentication. Without the need to provide valid authentication credentials, attackers can directly access and call backend core API operations to perform malicious operations, such as unauthorized reading and modification of system configurations, endpoint policies, or sensitive data.
Affected Versions
The following FortiClient EMS versions are affected:
7.4.5 ≤ FortiClient EMS ≤ 7.4.6
Solutions
Remediation Solutions
Official Solutions
Security patches have been officially released to fix the vulnerability. Affected users are advised to apply hotfixes to FortiClient EMS 7.4.5 and 7.4.6.
Download links:
FortiClient EMS 7.4.5: https://docs.fortinet.com/document/forticlient/7.4.5/ems-release-notes/832484
FortiClient EMS 7.4.6: https://docs.fortinet.com/document/forticlient/7.4.6/ems-release-notes/832484
Temporary Solutions
- Disable unused functional modules to reduce attack entry points.
- Follow the principle of least privilege to strictly control the scope of permissions for sensitive operations.
- Do not expose services to the Internet unless necessary, to limit the access sources to trusted ranges.
- Regularly update the system and components to secure versions so that known vulnerabilities can be patched at the earliest opportunity.
Sangfor Solutions
Proactive Vulnerability Detection
The following Sangfor service can proactively detect CVE-2026-35616 vulnerabilities and quickly identify vulnerability risks in batches in business scenarios:
- Athena Managed Detection and Response (MDR): The corresponding detection solution will be released on May 30, 2026. The rule ID is SF-2026-01014.
- Athena Extended Detection and Response (XDR): The corresponding detection solution will be released on April 26, 2026. The rule ID is SF-2026-00903.
Vulnerability Monitoring
The following Sangfor services support CVE-2026-35616 vulnerability monitoring, and can quickly identify affected assets and the impact scope in business scenarios in real time through traffic collection:
- Athena Network Detection and Response (NDR): The corresponding monitoring solution will be released on April 24, 2026. The rule ID is 11220409.
- Athena MDR: The corresponding monitoring solution will be released on April 24, 2026. The rule ID is 11220409. In this case, make sure that Athena MDR is integrated with Athena NDR.
- Athena XDR: The corresponding monitoring solution will be released on April 24, 2026. The rule ID is 11220409.
Vulnerability Prevention
The following Sangfor services can effectively block CVE-2026-35616 exploits:
- Athena Next-Generation Firewall (NGFW): The corresponding prevention solution will be released on April 24, 2026. The rule ID is 11220409.
- Sangfor Web Application Firewall (WAF): The corresponding prevention solution will be released on April 24, 2026. The rule ID is 11220409.
- Athena MDR: The corresponding prevention solution will be released on April 24, 2026. The rule ID is 11220409. In this case, make sure that Athena MDR is integrated with Athena NGFW.
- Athena XDR: The corresponding prevention solution will be released on April 24, 2026. The rule ID is 11220409. In this case, make sure that Athena XDR is integrated with Athena NGFW.
Timeline
On April 21, 2026, Sangfor FarSight Labs received notification of the authentication bypass vulnerability in FortiClient EMS (CVE-2026-35616).
On April 22, 2026, Sangfor FarSight Labs released a vulnerability alert.
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-099
Learn More
Sangfor FarSight Labs researches the latest cyber threats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyber threats, providing fast and easy protection for customers.
