CVE-2026-35616: Fortinet FortiClient EMS Exploitation — Detection and Remediation Guide

---
title: FortiClient EMS Potential Exploitation - Anomalous API Access
id: 8a4b2c1d-9e6f-4a3b-8c2d-1f4e5a6b7c8d
status: experimental
description: Detects potential exploitation of CVE-2026-35616 via suspicious access patterns to FortiClient EMS API endpoints without standard authentication headers or known exploit paths.
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/06/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - cve-2026-35616
logsource:
  category: webserver
  product: fortinet
detection:
  selection:
    c-uri|contains:
      - '/api/logon'
      - '/api/v1'
    cs-method: 'POST'
  filter_legit:
    sc-status: 
      - 200
      - 401
  condition: selection and not filter_legit
falsepositives:
  - Legitimate API scanning by administrators
  - Misconfigured monitoring tools
level: high
---
title: FortiClient EMS Service Spawning Windows Shell
id: 9c5d3e2f-0a7b-4c9d-8e1f-2a3b4c5d6e7f
status: experimental
description: Detects post-exploitation behavior where the FortiClient EMS Java service spawns cmd.exe or powershell.exe, indicative of RCE achieved via web interface exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - cve-2026-35616
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\FortiClientEMS\'
      - '\Apache Tomcat\'
      - '\Java\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Administrative maintenance via EMS console
level: critical

// Hunt for suspicious access to FortiClient EMS Management Ports
// EMS typically runs on port 8013 or standard 443
let EMS_Port = 8013;
DeviceNetworkEvents
| where RemotePort == EMS_Port or LocalPort == EMS_Port
| where InitiatingProcessFileName !in ("FortiClientEMS.exe", "javaw.exe", "msiexec.exe")
| summarize count() by DeviceName, InitiatingProcessFileName, RemoteIP
| where count_ > 10
| project DeviceName, InitiatingProcessFileName, RemoteIP, count_


// Hunt for EMS Service spawning shells (Post-Exploitation)
DeviceProcessEvents
| where InitiatingProcessFolderPath contains @"Fortinet\FortiClientEMS" 
   or InitiatingProcessFileName =~ "java.exe"
| where ProcessVersionInfoCompanyName == "Fortinet" or InitiatingProcessCommandLine contains "fcems"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, CommandLine

-- Hunt for processes spawned by FortiClient EMS or Java that are shells
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.CommandLine AS ParentCmd
FROM pslist()
WHERE Name IN ('cmd.exe', 'powershell.exe', 'pwsh.exe')
  AND (Parent.Name =~ 'java.exe' 
       OR Parent.CommandLine =~ 'FortiClientEMS'
       OR ParentExe =~ 'FortiClientEMS')

# FortiClient EMS - Remediation Verification Script
# Checks service status and suggests patching for CVE-2026-35616

Write-Host "Checking FortiClient EMS Service Status..." -ForegroundColor Cyan

$serviceName = "FortiClient EMS Service"
$service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue

if ($service) {
    Write-Host "[+] Service Found: $($service.DisplayName)" -ForegroundColor Green
    Write-Host "    Status: $($service.Status)"
    Write-Host "    Start Type: $($service.StartType)"
    
    # Attempt to find installation path and version
    $regPath = "HKLM:\SOFTWARE\Fortinet\FortiClientEMS"
    if (Test-Path $regPath) {
        $installPath = (Get-ItemProperty $regPath).InstallPath
        if ($installPath) {
            Write-Host "    Install Path: $installPath"
            $exePath = Join-Path $installPath "FortiClientEMS.exe"
            if (Test-Path $exePath) {
                $versionInfo = (Get-Item $exePath).VersionInfo
                Write-Host "    Current Version: $($versionInfo.FileVersion)" -ForegroundColor Yellow
                Write-Host ""
                Write-Host "[!] ACTION REQUIRED:" -ForegroundColor Red
                Write-Host "    1. Verify this version against the Fortinet Advisory for CVE-2026-35616."
                Write-Host "    2. If the version is older than the fixed release, update immediately."
                Write-Host "    3. Ensure the EMS interface is not exposed to the public internet."
            }
        }
    }
} else {
    Write-Host "[-] FortiClient EMS Service not found on this host." -ForegroundColor Gray
}