CVE-2026-35616

The vulnerability results from improper access control implementation (CWE-284), which does not require the attacker to possess any credentials. An attacker can send specially crafted network requests to the vulnerable FortiClientEMS server, bypassing authentication mechanisms. As a result, arbitrary code or commands can be executed in the context of the application.

An attacker gains the ability to execute code or commands without authorization on the vulnerable system without requiring authentication, which may lead to complete takeover of the FortiClientEMS server and compromise of data confidentiality, integrity, and availability.

Apply patches available from the vendor immediately according to references published by Fortinet at https://fortiguard.fortinet.com/psirt/FG-IR-26-099. Until updates are deployed, it is recommended to restrict access to the FortiClientEMS interface to trusted IP addresses only and implement network segmentation.

Fortinet FortiClientEMS versions 7.4.5 and 7.4.6

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.