CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control -- Unauthenticated RCE

Background

Fortinet FortiClient EMS (Endpoint Management Server) is the centralised server component of Fortinet’s FortiClient endpoint security suite. EMS manages endpoint security policies for FortiClient installations across corporate endpoints — controlling VPN configuration, web filtering, vulnerability scanning, and application control. FortiClient EMS is typically deployed in enterprise environments and is internet-accessible to enable management of remote and mobile endpoints connecting via FortiGate SSL-VPN.

Fortinet products have been a recurring focus for threat actors, with CVE-2023-48788 (SQL injection RCE in FortiClient EMS) being exploited by multiple threat groups including ransomware operators in 2024. CVE-2026-35616 represents a continuation of this attack surface. The combination of internet exposure (required for remote endpoint management) and improper access controls creates a directly exploitable vulnerability. CISA added this to the KEV catalogue on 2026-04-06.

Technical Mechanism

CVE-2026-35616 is an improper access control vulnerability (CWE-284) in Fortinet FortiClient EMS. Improper access control vulnerabilities occur when an application fails to adequately restrict access to resources or functionality, either by missing checks entirely or by using checks that can be bypassed.

In FortiClient EMS, the affected functionality involves the server accepting requests — likely via the management API or a web service endpoint — and executing code or performing privileged operations without properly verifying that the requester is authenticated and authorised:

1. An attacker identifies an internet-accessible FortiClient EMS server (typically exposed on TCP 8013 or 443 for endpoint communication and management)
2. The attacker sends a crafted HTTP or API request to the vulnerable endpoint
3. The access control check either does not execute or is bypassed by the crafted request structure
4. The server executes the requested operation, which includes code execution capability
5. The attacker achieves RCE under the EMS service account context (typically running as SYSTEM on Windows)

The Windows-based deployment of FortiClient EMS (running as SYSTEM) makes exploitation particularly impactful — SYSTEM-level code execution on the EMS server provides complete control of the management server and all endpoint policies it manages.

Real-World Exploitation Evidence

CVE-2026-35616 was added to CISA KEV on 2026-04-06. The broader context of Fortinet exploitation is significant:

• Multiple ransomware groups have historically exploited FortiClient EMS vulnerabilities (CVE-2023-48788 saw exploitation by multiple ransomware operators and initial access brokers in 2024)
• Nation-state actors — Fortinet products are targeted by Chinese, Russian, and Iranian state-sponsored groups seeking persistent network access
• Access broker ecosystem — compromised FortiClient EMS servers are particularly valuable to access brokers because EMS manages VPN configurations that can be leveraged to establish persistent, legitimate-appearing network access
• The pattern of repeated Fortinet EMS vulnerabilities suggests that security practitioners should audit all FortiClient EMS deployments regardless of patch status, looking for signs of prior compromise

Impact Assessment

Exploitation of CVE-2026-35616 gives an unauthenticated attacker code execution as SYSTEM on the Windows-based FortiClient EMS server. SYSTEM-level access to EMS means the attacker controls the management server that pushes endpoint security policies to every FortiClient-managed endpoint in the organisation. From this position, the attacker can read or modify VPN configuration templates, extract LDAP and Active Directory integration credentials, and obtain the preshared keys or API tokens used to communicate with FortiGate firewalls. These credentials enable persistent, legitimate-appearing VPN access to the corporate network using endpoint certificates managed by EMS.

The organisational impact is compounded by the internet-exposed nature of EMS, which is required for remote endpoint management. Ransomware operators and access brokers have specifically targeted this attack surface because EMS compromise provides a durable foothold: VPN configuration changes pushed through EMS to managed endpoints can be used to maintain access even after the EMS server itself is remediated, if those endpoint changes are not detected and reversed. Organisations in sectors with large remote workforces, where FortiClient EMS manages thousands of endpoint VPN connections, face the greatest exposure to this cascading risk.

Affected Versions

Consult the Fortinet PSIRT advisory FG-IR-26-XXXX for precise version ranges.

Remediation Steps

1. Apply the Fortinet patch immediately — check the FortiClient EMS version against the PSIRT advisory
2. If patching is delayed, restrict access to FortiClient EMS management ports to trusted IP addresses only:
   • Default management port TCP 8013 should not be internet-accessible
   • Create firewall rules permitting only FortiGate gateways and administrator workstations to reach EMS
3. Rotate all credentials stored in or used by FortiClient EMS:
   • Service account passwords
   • LDAP/AD integration credentials
   • Any FortiGate preshared keys or API tokens
4. Review Windows Event Logs on the EMS server for SYSTEM-level process creation events outside normal EMS service behaviour
5. Check for new user accounts added to the EMS server
6. Audit endpoint policies managed by EMS for unexpected changes (VPN configurations, web filter bypasses)
7. Review FortiGate logs for VPN connections from unexpected IP addresses using endpoint certificates managed by EMS
8. If compromise is suspected, rebuild the EMS server from a clean image

Detection Guidance

FortiClient EMS logs — review for:

• API requests to management endpoints from unexpected source IP addresses
• Requests without valid authentication tokens that receive non-error responses
• Configuration change events not correlated with administrator activity

Windows Event Logs on EMS server:

• Event ID 4688: Process creation events spawned by the EMS service
• Event ID 4720: New local user account creation
• Event ID 7045: New service installation

SIEM query example (Splunk):

index=windows_events host=forticlient_ems EventCode=4688
| where ParentProcessName like "%FortiClientEMS%"
| where NOT (CommandLine like "%ForitClientEMS%")
| stats count by ComputerName, ProcessName, CommandLine, ParentProcessName
| sort -count

Network indicators:

• Unexpected outbound connections from the EMS server host to external IP addresses
• Connections to EMS management ports from IP addresses outside the known FortiGate and admin ranges

Timeline

References

• NVD — CVE-2026-35616
• CISA KEV — CVE-2026-35616
• Fortinet PSIRT Advisory — CVE-2026-35616