One Forged Header: Unauthenticated Authentication Bypass in Fortinet FortiClient EMS (CVE-2026-35616)
Fortinet FortiClient EMS authentication bypass (CVE-2026-35616) exploited in wild
Run Fortinet?
Get an email when a reviewed story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Fortinet disclosed CVE-2026-35616, a critical authentication bypass (CVSS 9.1) in FortiClient EMS versions 7.4.5–7.4.6 that allows unauthenticated attackers to forge an HTTP header and gain full administrator access to the API. The flaw stems from improper header validation and weak certificate chain verification. Active exploitation was detected on March 31, 2026, before the advisory, and CISA added it to the Known Exploited Vulnerabilities list.
The lesson from this incident
Full lessonCVE-2026-35616 demonstrates how improper HTTP header validation can lead to complete authentication bypass, allowing attackers to gain full administrator access without credentials. The vulnerability was actively exploited before public disclosure, highlighting the critical importance of rapid vulnerability management for internet-facing security infrastructure. This incident shows that even security appliances can contain fundamental authentication flaws that completely undermine their protective purpose. Organizations relying on affected FortiClient EMS versions faced complete compromise of their endpoint management capabilities.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-35616