Fortinet FortiClientEMS RCE exploited in wild
An unauthenticated remote code execution flaw in Fortinet FortiClientEMS is being actively exploited, affecting versions 7.4.5-7.4.6.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-35616 as exploited in the wild.
Fortinet FortiClientEMS, a centralized endpoint management platform, contains an improper access control vulnerability (CVE-2026-35616) that allows unauthenticated attackers to execute arbitrary code via crafted network requests. The flaw affects versions 7.4.5 through 7.4.6 and is exploited via public-facing application exposure, mapping to MITRE ATT&CK T1190. Fortinet has confirmed active exploitation in the wild, and the vulnerability requires no authentication, making internet-exposed EMS instances particularly at risk.
Successful exploitation grants code execution in the context of the FortiClientEMS service account, which could enable installation of malware, data manipulation or destruction, and creation of new privileged accounts depending on the service account's configured privileges. Organizations running least-privileged service accounts face reduced impact compared to those running with administrative rights. CISA/MS-ISAC recommend immediate application of Fortinet hotfixes, upgrading to 7.4.7 or later when available, applying least-privilege principles to service accounts, and standard vulnerability management practices including patch management, scanning, and network segmentation for exposed management interfaces.
Mentioned in this report
Detection guidance
FortiClientEMS Service Spawning Suspicious Child Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
FortiClientEMS service account executing cmd.exe, powershell.exe, or other shell interpreters post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiClientEMS Service Spawning Suspicious Child Process
description: Detects FortiClientEMS service processes (typically running as SYSTEM
or a service account) spawning command shells or scripting interpreters, indicative
of post-exploitation code execution. Generalises on the parent service process and
child shell spawning, not specific payloads.
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains:
- FortiClientEMS
- fortiemsagent
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
filter_legitimate_admin:
User|contains: SYSTEM
CommandLine|contains:
- FortiClient
- fortiemsagent
condition: selection and not filter_legitimate_admin
falsepositives:
- FortiClientEMS administrative tasks invoking scripts for legitimate system configuration
- Authorized system administrators directly executing remediation commands
level: high
id: 8694c16a-ca11-58aa-9513-bc15ee56fd96
status: experimental
author: Vorant
FortiClientEMS Service Creating or Modifying User Accounts
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
FortiClientEMS service account executing net.exe or PowerShell commands to create, modify, or add users to privileged groups post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiClientEMS Service Creating or Modifying User Accounts
description: Detects FortiClientEMS service spawning net.exe or powershell.exe to
create new user accounts or add accounts to administrative groups, typical post-exploitation
persistence technique.
tags:
- attack.t1190
- attack.persistence
logsource:
category: process_creation
product: windows
detection:
selection_net:
ParentImage|contains:
- FortiClientEMS
- fortiemsagent
Image|endswith: \net.exe
CommandLine|contains:
- 'user '
- 'localgroup '
- 'group '
selection_powershell:
ParentImage|contains:
- FortiClientEMS
- fortiemsagent
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains:
- New-LocalUser
- Add-LocalGroupMember
- Set-LocalUser
condition: selection_net or selection_powershell
falsepositives:
- Legitimate Fortinet provisioning or account management automation running in service
context
- Authorized system administrators executing account creation through FortiClientEMS
management interface
level: high
id: 9c32a9a7-dc43-55a8-9974-7c1591f487d9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-fortinet-forticlientemscould-allow-for-arbitrary-code-execution_2026-031
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs