CVE-2026-35616: Fortinet FortiClient EMS Zero-Day

Overview

Affected Versions

Description

An improper access control vulnerability exists in FortiClient EMS that allows unauthenticated remote code execution. An attacker can send crafted requests to bypass authentication and authorization protections entirely, achieving code execution on the underlying server without valid credentials or user interaction.

Key Points

• Authentication bypass: No credentials required
• Remote code execution: Full control of EMS server
• Active exploitation: Detected by watchTowr on March 31, 2026 (4 days before disclosure)
• Central management compromise: Control over entire endpoint fleet

Timeline

Impact Assessment

Enterprise Impact

• Endpoint fleet compromise: Attacker can push malicious policies to all managed endpoints
• VPN configuration manipulation: Modify VPN settings for persistence
• Lateral movement pivot: EMS server is a privileged access point
• Credential harvesting: Extract stored credentials and configurations

Homelab Impact

Risk Level: Medium (if using FortiClient EMS)

Most homelabs don’t run enterprise endpoint management. However, if you’re using FortiClient EMS for VPN management:

1. Check version immediately (see detection below)
2. Apply hotfix if running 7.4.5 or 7.4.6
3. Rotate credentials if compromise suspected

Detection

Check FortiClient EMS Version

# On EMS server (Windows)
# Navigate to installation directory
cd "C:\Program Files\Fortinet\FortiClientEMS\"

# Check version in console or via:
type bin\version.txt

# Or via Services console
# Look for "FortiClient Enterprise Management Server"

Detection via Logs (No IOCs Published)

Since Fortinet hasn’t published IOCs, look for:

# Check for anomalous API requests in IIS logs
# Look for patterns in:
C:\inetpub\logs\LogFiles\*

# Check for unexpected file modifications
Get-ChildItem "C:\Program Files\Fortinet\FortiClientEMS\" -Recurse |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
  Select-Object FullName, LastWriteTime

Network Indicators

• Unexpected outbound connections from EMS server
• API requests from unusual source IPs
• Large data transfers after business hours

Remediation

Immediate Actions

1. Identify all FortiClient EMS instances in your environment
2. Check versions against affected list (7.4.5, 7.4.6)
3. Apply hotfix from Fortinet (no reboot required):
   • Download from Fortinet Support
   • Follow release notes for your version
4. Plan upgrade to 7.4.7 when available

If Compromise Suspected

# DO NOT attempt in-place cleanup

# 1. Isolate the EMS server
# 2. Preserve logs for forensics
# 3. Restore from known-good backup
# OR
# 4. Rebuild from scratch and migrate data
# 5. Rotate ALL credentials stored in EMS
# 6. Audit endpoint policies for malicious changes

References

• Fortinet Advisory (check PSIRT)
• CISA KEV Catalog
• watchTowr Analysis

Related CVEs

• CVE-2026-21643: Previous FortiClient EMS RCE (March 2026)
• CVE-2024-3400: Palo Alto GlobalProtect RCE (April 2024)

Last updated: April 7, 2026