FortiClientEMS RCE exploited in wild
Fortinet FortiClientEMS versions 7.4.5-7.4.6 contain an actively exploited improper access control flaw allowing unauthenticated remote code execution via crafted requests.
Fortinet has disclosed that CVE-2026-35616, an improper access control vulnerability in FortiClientEMS versions 7.4.5 through 7.4.6, is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary code or commands via crafted network requests, bypassing authentication entirely. FortiClientEMS is a centralized management platform used to deploy and enforce security policies across endpoints running the FortiClient agent.
Successful exploitation enables arbitrary code execution in the context of the affected service account. Impact severity depends on the privileges of the compromised account — administrative service accounts would grant attackers the ability to install programs, manipulate data, or create new accounts with full rights. The MS-ISAC advisory maps this to MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) under the Initial Access tactic.
Fortinet has released hotfixes for affected versions, with version 7.4.7 recommended as a long-term remediation. Organizations running FortiClientEMS should apply patches immediately after testing. The advisory emphasizes defense-in-depth measures including least-privilege configurations, network segmentation, and routine vulnerability scanning to mitigate the risk of exploitation.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by FortiClientEMS Service
Detects command interpreters or scripting engines spawned from FortiClientEMS server/daemon processes, indicating possible exploitation of CVE-2026-35616 leading to arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by FortiClientEMS Service
id: 562e1da6-d316-57ab-ad90-6f15c3e808cb
status: experimental
description: Detects cmd.exe, powershell.exe, or other interpreters spawned as children
of FortiClientEMS server processes, consistent with exploitation of CVE-2026-35616
(improper access control leading to unauthenticated RCE).
references:
- https://www.fortiguard.com/psirt
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains:
- FortiClientEMS
- FCMDaemon
- FCMDBEngine
- EMSMgmt
- EMS Server
suspicious_child:
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\rundll32.exe
- \\mshta.exe
- \\certutil.exe
condition: selection and suspicious_child
falsepositives:
- Legitimate administrative scripts or maintenance tasks triggered by EMS management
console automation
- Third-party endpoint management integrations that legitimately invoke command-line
tools from EMS service context
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant
SQL Server Process Spawning Command Interpreter (EMS Backend RCE)
Detects sqlservr.exe spawning shell or scripting processes, a common post-exploitation pattern when SQL-based EMS backend components are abused for arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Server Process Spawning Command Interpreter (EMS Backend RCE)
id: 15b46434-3dc1-52f6-a247-9c53051bd002
status: experimental
description: Detects sqlservr.exe (SQL Server engine used by FortiClientEMS backend)
spawning cmd.exe, powershell.exe, or similar processes, indicative of SQL injection
or command execution abuse chained from FortiClientEMS vulnerabilities such as CVE-2026-35616.
references:
- https://www.fortiguard.com/psirt
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\sqlservr.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\rundll32.exe
condition: selection
falsepositives:
- Database administration scripts that legitimately call xp_cmdshell for maintenance
tasks
- Backup or monitoring agents integrated with the SQL Server instance backing FortiClientEMS
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant
FortiClientEMS Service Initiating Unusual Outbound Network Connection
Detects FortiClientEMS server processes initiating outbound network connections to non-standard destinations, potentially indicating post-exploitation callback or lateral movement following RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiClientEMS Service Initiating Unusual Outbound Network Connection
id: 9ca68b8c-ee21-56e6-a7c1-fb4aed951cee
status: experimental
description: Detects network connections initiated by FortiClientEMS-related server
processes to external hosts, which may indicate command-and-control or data exfiltration
activity following exploitation of CVE-2026-35616.
references:
- https://www.fortiguard.com/psirt
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains:
- FortiClientEMS
- FCMDaemon
- FCMDBEngine
- EMSMgmt
Initiated: true
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate EMS-to-FortiClient agent communication to internal endpoints not covered
by RFC1918 filter
- Update or license-check connections made by the EMS service to Fortinet cloud services
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-fortinet-forticlientemscould-allow-for-arbitrary-code-execution_2026-031
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free