FortiClient EMS Zero-Day (CVE-2026-35616): Patch ASAP
Heads up, everyone. Fortinet just dropped an out-of-band patch for a critical vulnerability in FortiClient EMS (CVE-2026-35616). It's rated a 9.1 on the CVSS scale, and yes, it's being actively exploited in the wild.
The flaw is an Improper Access Control vulnerability (CWE-284) that allows for pre-authentication API access bypass. Essentially, an unauthenticated attacker can hit specific API endpoints and escalate privileges. Given that EMS is the central management console, this gives an attacker the keys to the kingdom—remote code execution on all connected endpoints is likely the endgame here.
If you haven't patched, verify your build immediately. Do not rely on the dashboard alone if you suspect compromise.
Here is a quick PowerShell snippet to check the installed version on your EMS servers:
Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*FortiClient*EMS*"} | Select-Object Name, Version
For detection, start hunting your web server logs (usually IIS) for anomalous API calls. Since it's a bypass, look for successful POST or PUT requests to administrative API routes without a preceding authentication event or valid session token.
Example KQL query for Sentinel/Defender:
DeviceNetworkEvents
| where RemoteUrl contains "/api" and ActionType == "HttpResponse"
| where ResponseCode == 200
| where InitiatingProcessFileName != "FortiClientEMS.exe"
| project Timestamp, DeviceName, RemoteUrl, RequestBody
Is anyone else seeing scanning activity against port 443 or the specific API endpoints on their EMS instances today?
Good timing on this post. We saw a spike in 401s turning into 200s on our external-facing EMS firewall rules about two hours ago. The traffic looked like it was probing /api/v1/ endpoints directly. We blocked the originating IPs at the edge, but the patch is deploying now. If you can't patch immediately, restrict access to /api subdirectories to only known management IP ranges.
This is a nightmare for MSPs. We manage about 40 EMS instances, and restarting the EMS service for the update breaks the heartbeat for connected agents for a few minutes. Make sure you schedule this during maintenance windows or notify clients, otherwise your helpdesk will get flooded with 'endpoint offline' alerts.
I'm reviewing the patch notes, and the fix is specifically around the validation of the X-Forwarded-For header and session tokens in the API handler. If you are running EMS behind a reverse proxy, ensure you aren't blindly trusting forwarded headers until you've updated. An attacker can easily spoof that to bypass the logic if the service is misconfigured.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access