Public PoC released for critical FortiClient EMS authentication bypass exploited in the wild

The vulnerability and the released PoC

A public proof-of-concept (PoC) exploit for CVE-2026-35616, a critical authentication and authorization bypass in Fortinet's FortiClient Endpoint Management Server (EMS), was published on GitHub on Oct. 15, 2026. The repository, released by user Alaatk, contains a Python script named `cve_2026_35616.py` that targets protected API endpoints on vulnerable servers and accepts a target address with an optional port. The repository's documentation describes the issue as a pre-authentication bypass rather than one that requires stolen administrator credentials, and the author restricts intended use to testing conducted with explicit written permission from the system owner. Because the code is public, defenders can use it to validate exposure, but it is also available to anyone probing reachable servers.

Scope, severity and exploitation status

Fortinet classifies CVE-2026-35616 as an improper access control weakness (CWE-284) and assigns it a CVSS score of 9.1. The flaw affects FortiClient EMS versions 7.4.5 and 7.4.6; the 7.2 branch is listed as unaffected. Fortinet confirms the vulnerability has been exploited in the wild, and an earlier in-the-wild incident involving the same CVE was tied to attackers pushing a fake Fortinet patch that installed credential-stealing malware on managed endpoints. Because EMS centrally administers FortiClient deployments, an unauthenticated attacker reaching the management API could obtain a foothold on a central endpoint-administration system.

Remediation guidance from Fortinet

Fortinet's advisory FG-IR-26-099 directs affected organizations to upgrade FortiClient EMS to version 7.4.7 or later and provides separate hotfix instructions for versions 7.4.5 and 7.4.6, stating that the hotfixes fully prevent exploitation. Fortinet also says it has already remediated the issue in FortiClient Cloud and FortiSASE, so customers of those services do not need to take action. Administrators are advised to identify every FortiClient EMS deployment, confirm the exact running version, apply the vendor hotfix or upgrade to 7.4.7, and verify the resulting version after maintenance.

What defenders should do now

In addition to patching, Fortinet and the reporting outlets recommend restricting the EMS management interface to trusted networks, reviewing available logs for unusual API requests or unexpected configuration changes, and investigating any signs of unauthorized activity. Organizations whose EMS servers were reachable from the internet while unpatched are urged to prioritize review of those systems. A PoC test against internal, authorized hosts is described as a useful way to confirm exposure, but the reporting stresses that it should not replace applying the vendor fix or a broader compromise assessment.

Caveats around the released code

The available README does not document a verified success rate, a full list of prerequisites beyond the requests, urllib3 and cryptography Python packages and an OpenSSL executable on the system PATH, or evidence that the script achieves every impact described in Fortinet's advisory. Its documented API bypass capability and the vendor's assessment of possible command execution therefore remain separate claims. The repository also does not indicate how many systems are vulnerable or confirm any compromise of a specific organization.

Next verifiable milestone

Administrators running FortiClient EMS 7.4.5 or 7.4.6 are expected to move to 7.4.7 or apply the Fortinet hotfix, with the next observable signal being the post-maintenance version reported by each EMS instance and any subsequent Fortinet PSIRT updates to advisory FG-IR-26-099.