CVE-2026-35616: FortiClient EMS Actively Exploited — Detection and Patching Guide

---
title: FortiClient EMS Pre-Auth API Access Attempt
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential pre-authentication API access attempts against FortiClient EMS by identifying suspicious API endpoints accessed without a valid session token or referrer.
references:
  - https://fortiguard.com/encyclopedia?type=ips&id=45000  
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: iis
detection:
  selection:
    c-uri|contains:
      - '/api/v1/'
      - '/api/v2/'
      - '/rpc/'
    cs-uri-query|contains:
      - 'uid='
      - 'session='
  filter:
    cs-cookie|contains: 'FCSESSID='
  condition: selection and not filter
falsepositives:
  - Legitimate administrative API access from non-standard clients
level: high
---
title: FortiClient EMS Service Spawning Shell
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the FortiClient EMS Windows service spawning cmd.exe or powershell.exe, a common post-exploitation behavior following privilege escalation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \\FortiClientEMSService.exe
    Image|endswith:
      - \\cmd.exe
      - \\powershell.exe
      - \\pwsh.exe
  condition: selection
falsepositives:
  - Legitimate administrative debugging (rare)
level: critical
---
title: Suspicious File Writes in FortiClient EMS Directory
id: 0c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects creation of executables or scripts within the FortiClient EMS installation directory by users other than the installer or service account.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.lateral_movement
  - attack.t1105
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\FortiClient EMS\\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
  filter:
    User|contains:
      - 'SYSTEM'
      - 'Administrator'
  condition: selection and not filter
falsepositives:
  - Software updates or legitimate plugin installations
level: medium

// Hunt for suspicious API access patterns on IIS servers hosting FortiClient EMS
// Look for 200 OK responses to API endpoints without authentication headers
let EMS_Servers = DeviceProcessEvents
| where ProcessName contains "FortiClientEMSService.exe"
| distinct DeviceName;
W3CIISLog
| where ComputerName in (EMS_Servers)
| where scStatus == 200
| where csUriStem has "/api/"
| where isnull(csCookie) or csCookie !contains "FCSESSID"
| project TimeGenerated, ComputerName, cIP, csUriStem, csUriQuery, csUserAgent, scStatus
| order by TimeGenerated desc

-- Hunt for suspicious child processes spawned by FortiClient EMS Service
SELECT Parent.ProcessName AS ParentProcess, Parent.Pid AS ParentPid,
       Process.Name AS ProcessName, Process.Pid, Process.CommandLine,
       Process.Username, Process.CreateTime
FROM pslist()
LEFT JOIN pslist() AS Parent ON Process.Ppid = Parent.Pid
WHERE Parent.ProcessName =~ "FortiClientEMSService.exe"
  AND Process.Name =~ "(cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe)"

# Check FortiClient EMS Version for CVE-2026-35616 Vulnerability
# Note: Update the $SafeVersion variable based on the official Fortinet advisory

$SafeVersion = "7.4.2" # Example placeholder, verify exact patched version in Fortinet advisory
$RegistryPath = "HKLM:\SOFTWARE\Fortinet\FortiClientEMS"
$CurrentVersion = $null

if (Test-Path $RegistryPath) {
    $CurrentVersion = (Get-ItemProperty -Path $RegistryPath -ErrorAction SilentlyContinue).DisplayVersion
    
    if ($CurrentVersion) {
        Write-Host "Detected FortiClient EMS Version: $CurrentVersion" -ForegroundColor Cyan
        
        # Simple version comparison logic (adjust for complex version strings)
        if ([version]$CurrentVersion -lt [version]$SafeVersion) {
            Write-Host "[VULNERABLE] System is running a version vulnerable to CVE-2026-35616." -ForegroundColor Red
            Write-Host "Action Required: Patch to $SafeVersion or higher immediately." -ForegroundColor Yellow
        }
        else {
            Write-Host "[OK] System appears to be patched." -ForegroundColor Green
        }
    }
    else {
        Write-Host "Unable to determine version from registry." -ForegroundColor Yellow
    }
}
else {
    Write-Host "FortiClient EMS not found on this system." -ForegroundColor Gray
}