VORANT. Threat Intelligence Sign in Get the full feed

Fortinet FortiClientEMS RCE exploited in wild

high vulnerability government-national

An unauthenticated remote code execution flaw in Fortinet FortiClientEMS is being actively exploited, affecting versions 7.4.5-7.4.6.

Fortinet FortiClientEMS, a centralized endpoint management platform, contains an improper access control vulnerability (CVE-2026-35616) that allows unauthenticated attackers to execute arbitrary code via crafted network requests. The flaw affects versions 7.4.5 through 7.4.6 and is exploited via public-facing application exposure, mapping to MITRE ATT&CK T1190. Fortinet has confirmed active exploitation in the wild, and the vulnerability requires no authentication, making internet-exposed EMS instances particularly at risk.

Successful exploitation grants code execution in the context of the FortiClientEMS service account, which could enable installation of malware, data manipulation or destruction, and creation of new privileged accounts depending on the service account's configured privileges. Organizations running least-privileged service accounts face reduced impact compared to those running with administrative rights. CISA/MS-ISAC recommend immediate application of Fortinet hotfixes, upgrading to 7.4.7 or later when available, applying least-privilege principles to service accounts, and standard vulnerability management practices including patch management, scanning, and network segmentation for exposed management interfaces.

Mentioned in this report

Vulnerabilities CVE-2026-35616KEV

Related reporting

Detection guidance

FortiClientEMS Service Spawning Suspicious Child Process

ATT&CK T1190

FortiClientEMS service account executing cmd.exe, powershell.exe, or other shell interpreters post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiClientEMS Service Spawning Suspicious Child Process
description: Detects FortiClientEMS service processes (typically running as SYSTEM
  or a service account) spawning command shells or scripting interpreters, indicative
  of post-exploitation code execution. Generalises on the parent service process and
  child shell spawning, not specific payloads.
tags:
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
    - FortiClientEMS
    - fortiemsagent
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
  filter_legitimate_admin:
    User|contains: SYSTEM
    CommandLine|contains:
    - FortiClient
    - fortiemsagent
  condition: selection and not filter_legitimate_admin
falsepositives:
- FortiClientEMS administrative tasks invoking scripts for legitimate system configuration
- Authorized system administrators directly executing remediation commands
level: high
id: 8694c16a-ca11-58aa-9513-bc15ee56fd96
status: experimental
author: Vorant

FortiClientEMS Service Accessing SYSTEM Account Credentials

ATT&CK T1190

FortiClientEMS service process accessing Local Security Authority Subsystem Service (LSASS) or SAM registry hive, indicating credential dumping post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiClientEMS Service Accessing SYSTEM Account Credentials
description: Detects FortiClientEMS processes attempting to access LSASS process or
  SAM registry hive following exploitation, typical of post-exploitation privilege
  escalation or lateral movement preparation.
tags:
- attack.t1190
- attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_lsass:
    ParentImage|contains:
    - FortiClientEMS
    - fortiemsagent
    TargetImage|endswith: \lsass.exe
  selection_reg:
    ParentImage|contains:
    - FortiClientEMS
    - fortiemsagent
    CommandLine|contains:
    - reg save HKLM\\SAM
    - reg export HKLM\\SAM
  condition: selection_lsass or selection_reg
falsepositives:
- Legitimate Fortinet EMS diagnostic or health-check tools accessing system state
- Third-party authorized EDR products monitoring FortiClientEMS process context
level: high
id: 1c104ca0-ba96-5333-8323-3c11a86af8df
status: experimental
author: Vorant

FortiClientEMS Service Creating or Modifying User Accounts

ATT&CK T1190

FortiClientEMS service account executing net.exe or PowerShell commands to create, modify, or add users to privileged groups post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiClientEMS Service Creating or Modifying User Accounts
description: Detects FortiClientEMS service spawning net.exe or powershell.exe to
  create new user accounts or add accounts to administrative groups, typical post-exploitation
  persistence technique.
tags:
- attack.t1190
- attack.persistence
logsource:
  category: process_creation
  product: windows
detection:
  selection_net:
    ParentImage|contains:
    - FortiClientEMS
    - fortiemsagent
    Image|endswith: \net.exe
    CommandLine|contains:
    - 'user '
    - 'localgroup '
    - 'group '
  selection_powershell:
    ParentImage|contains:
    - FortiClientEMS
    - fortiemsagent
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - New-LocalUser
    - Add-LocalGroupMember
    - Set-LocalUser
  condition: selection_net or selection_powershell
falsepositives:
- Legitimate Fortinet provisioning or account management automation running in service
  context
- Authorized system administrators executing account creation through FortiClientEMS
  management interface
level: high
id: 9c32a9a7-dc43-55a8-9974-7c1591f487d9
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-fortinet-forticlientemscould-allow-for-arbitrary-code-execution_2026-031

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free