erroneo.us
Search all guides⌘K

Security Digest · Feb 6, 2026 · Vulnerability · Other

FortiClient EMS: Exploited Pre-Auth SQLi and API Bypass

Two unauthenticated FortiClient EMS 7.4 bugs, both exploited; one was used to push an infostealer to endpoints. Fixed in 7.4.5 and 7.4.7. Verify and hunt.

Published By erroneo.us Security Desk · Updated 3 min read15 sources

Our verdict

Check exposure

Both bugs are fixed and both were exploited, one to push malware to managed laptops. Confirm EMS runs 7.4.7 or later (or the unaffected 7.2 or 8.0 lines), keep its web interface off the internet, and hunt for rogue scripts in profiles.

Who must act: Anyone running on-premises FortiClient EMS 7.4.4, 7.4.5 or 7.4.6 since February 2026, especially with the EMS web interface reachable from the internet.

Who can relax: FortiClient EMS 7.2 and 8.0 users, FortiClient Cloud and FortiSASE customers (Fortinet remediated those itself), and 7.4.4 single-site deployments for CVE-2026-21643.

Affected
FortiClient EMS 7.4.4 (CVE-2026-21643; multi-tenant Sites mode, per Bishop Fox)
FortiClient EMS 7.4.5 through 7.4.6 (CVE-2026-35616)
Fixed in
FortiClient EMS 7.4.7 or later (fixes both)
FortiClient EMS 7.4.5 fixes CVE-2026-21643 only
Fortinet hotfix for 7.4.5 and 7.4.6 (CVE-2026-35616)
CVSS
9.8 (v3.1, vendor)
EPSS
94.0% (percentile 99.8)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check the version of every EMS server; 7.4.4, 7.4.5 and 7.4.6 are affected.
  2. Upgrade to FortiClient EMS 7.4.7 or later; if you rely on the 7.4.5/7.4.6 hotfix, confirm ems-webserver.conf contains RequestHeader unset lines for X-SSL-CLIENT-VERIFY and X-SSL-CLIENT-CERT.
  3. Restrict the EMS web interface to management networks, and limit port 8013 to the address ranges your endpoints use.
  4. Review Remote Access Profiles and endpoint policies for scripts you did not add, especially on_connect scripts, and remove them.
  5. If you find compromise, restore EMS from a pre-compromise backup or rebuild it, rotate EMS admin credentials, API tokens and JWT secrets, and investigate every endpoint that received a rogue script.

How to check if you are affected or compromised

  • Search EMS logs for 'Certificate not found in request header.' followed by a fortinet-ca2 update, which Arctic Wolf saw during CVE-2026-35616 attacks.
  • In Apache access logs, look for HTTP 500 responses or bursts of requests to /api/v1/init_consts and slow /api/v1/auth/signin responses (CVE-2026-21643).
  • Look for new EMS admin accounts, logins from Tor exit nodes or VPS ranges, and changes to remind_upgrade_after.
  • On endpoints, hunt for cmd.exe or powershell.exe launched by fortitray.exe or ipsec.exe, FortiEndpoint_Patch.exe, C:\ProgramData\log.txt, and traffic to 83.138.53.110.

What happened#

FortiClient EMS, the server that manages FortiClient agents, had two unauthenticated flaws in consecutive 7.4 releases, and attackers used both.

On February 6, 2026, Fortinet published FG-IR-25-1142 for CVE-2026-21643, a SQL injection in EMS 7.4.4 that it found internally, and fixed it in 7.4.5. Bishop Fox showed that the Site header, which selects a tenant in multi-tenant mode, was pasted into a PostgreSQL query before login. The public /api/v1/init_consts endpoint returns database errors, so data can be pulled out quickly. In Fortinet's VM image, Bishop Fox reached OS command execution. SecurityWeek reported that Defused saw exploitation start in late March.

On April 4, Fortinet disclosed CVE-2026-35616 in FG-IR-26-099, an API authentication bypass in 7.4.5 and 7.4.6 that was already exploited. watchTowr saw attacks from March 31. Bishop Fox traced the bug to EMS trusting a client-supplied X-SSL-CLIENT-VERIFY header as proof of certificate login. Fortinet shipped hotfixes, and the 7.4.7 release notes list the bug as resolved. Fortinet rates both CVSS 3.1 9.8 (9.1 with temporal metrics). CISA added CVE-2026-35616 to KEV on April 6 and CVE-2026-21643 on April 13.

Who is affected#

CVE-2026-21643 hits 7.4.4. Bishop Fox says only multi-tenant (Sites) deployments are exposed. CVE-2026-35616 hits 7.4.5 and 7.4.6. Versions 7.2 and 8.0 are not affected by either bug, and Fortinet fixed FortiClient Cloud and FortiSASE itself. Note the trap: upgrading from 7.4.4 to 7.4.5 closes the SQL injection but opens the API bypass. The safe target is 7.4.7 or later.

Do you really need to act?#

Patching is old news by now, but hunting is not. EMS can push configuration and scripts to every managed laptop, so a compromised server is a fleet-wide problem. Arctic Wolf documented this in May 2026. Attackers used CVE-2026-35616 to log in from Tor exit nodes and add an on_connect script to a Remote Access Profile. When users connected to the VPN, the script ran a fake FortiEndpoint_Patch.exe, a browser credential stealer. No actor has been publicly named, and CISA lists ransomware use as unknown.

What to do now#

  1. Record the version of every EMS server.
  2. Upgrade to 7.4.7 or later. If you are relying on the hotfix, check it with grep -i "RequestHeader unset" ems-webserver.conf and expect entries for X-SSL-CLIENT-VERIFY and X-SSL-CLIENT-CERT.
  3. Keep the EMS web interface on management networks, and restrict port 8013 to your endpoint ranges.
  4. Audit Remote Access Profiles, endpoint policies and admin accounts for anything you did not create.
  5. If compromised, restore or rebuild EMS, rotate admin credentials, API tokens and JWT secrets, and reset the browser-stored credentials of affected users.

How to tell if you were hit#

For CVE-2026-35616, Arctic Wolf saw the EMS log line Certificate not found in request header., followed by a fortinet-ca2 update. Also look for new admins, logins from Tor or VPS ranges, and changes to remind_upgrade_after. On endpoints, look for fortitray.exe or ipsec.exe spawning cmd.exe and powershell.exe, scripts under FortiClient\logs\Trace\scripts\, and connections to 83.138.53.110. For CVE-2026-21643, Bishop Fox suggests looking for HTTP 500s or rapid repeats on /api/v1/init_consts. Also check PostgreSQL logs for SET search_path values that do not match fcm_<name>. Default Apache logs omit the Site header.

Timeline#

  • — Fortinet discloses CVE-2026-21643 and fixes it in EMS 7.4.5.
  • — Bishop Fox publishes its root-cause analysis.
  • — watchTowr sees exploitation of the unknown API bypass, after Defused reported CVE-2026-21643 attacks days earlier.
  • — Fortinet discloses CVE-2026-35616 and ships hotfixes for 7.4.5 and 7.4.6.
  • — CISA adds CVE-2026-35616 to KEV, with a federal due date of April 9.
  • — CISA adds CVE-2026-21643 to KEV, with a federal due date of April 16.
  • — Arctic Wolf reports EMS abuse delivering the EKZ infostealer.

Vulnerability records

  • CVE-2026-21643 · KEV 2026-04-13 · An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an…
  • CVE-2026-35616 · KEV 2026-04-06 · A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Fortinet PSIRT — FG-IR-25-1142: SQLi in administrative interface (CVE-2026-21643) fortiguard.fortinet.com
  2. Fortinet PSIRT — FG-IR-26-099: API authentication and authorization bypass (CVE-2026-35616) fortiguard.fortinet.com
  3. Fortinet — FortiClient EMS 7.4.7 release notes: resolved issues docs.fortinet.com
  4. CVE record — CVE-2026-21643 cve.org
  5. CVE record — CVE-2026-35616 cve.org
  6. NVD — CVE-2026-21643 nvd.nist.gov
  7. NVD — CVE-2026-35616 nvd.nist.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2026-35616 cisa.gov
  9. CISA — Known Exploited Vulnerabilities: CVE-2026-21643 cisa.gov
  10. Bishop Fox — CVE-2026-21643: Pre-authentication SQL injection in FortiClient EMS 7.4.4 bishopfox.com
  11. Bishop Fox — API authentication bypass in FortiClient EMS 7.4.5-7.4.6 (CVE-2026-35616) bishopfox.com
  12. Arctic Wolf — FortiClient EMS exploited via CVE-2026-35616 to deliver EKZ Infostealer arcticwolf.com
  13. watchTowr — FortiClient EMS zero-day CVE-2026-35616: active exploitation underway watchtowr.com

Coverage and analysis

  1. SecurityWeek — Exploitation of critical Fortinet FortiClient EMS flaw begins securityweek.com
  2. Help Net Security — FortiClient EMS zero-day exploited, emergency hotfixes available helpnetsecurity.com