---
title: "FortiClient EMS: Exploited Pre-Auth SQLi and API Bypass"
url: https://erroneo.us/security/briefs/forticlient-ems-cve-2026-21643-35616-unauth-rce/
description: "Two unauthenticated FortiClient EMS 7.4 bugs, both exploited; one was used to push an infostealer to endpoints. Fixed in 7.4.5 and 7.4.7. Verify and hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-02-06
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-21643", "CVE-2026-35616"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiClient EMS: Exploited Pre-Auth SQLi and API Bypass

**Verdict: Check exposure.** Both bugs are fixed and both were exploited, one to push malware to managed laptops. Confirm EMS runs 7.4.7 or later (or the unaffected 7.2 or 8.0 lines), keep its web interface off the internet, and hunt for rogue scripts in profiles.

- **Who must act:** Anyone running on-premises FortiClient EMS 7.4.4, 7.4.5 or 7.4.6 since February 2026, especially with the EMS web interface reachable from the internet.
- **Who can relax:** FortiClient EMS 7.2 and 8.0 users, FortiClient Cloud and FortiSASE customers (Fortinet remediated those itself), and 7.4.4 single-site deployments for CVE-2026-21643.
- **Affected:** FortiClient EMS 7.4.4 (CVE-2026-21643; multi-tenant Sites mode, per Bishop Fox); FortiClient EMS 7.4.5 through 7.4.6 (CVE-2026-35616)
- **Fixed:** FortiClient EMS 7.4.7 or later (fixes both); FortiClient EMS 7.4.5 fixes CVE-2026-21643 only; Fortinet hotfix for 7.4.5 and 7.4.6 (CVE-2026-35616)
- **CVEs:** CVE-2026-21643, CVE-2026-35616
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version of every EMS server; 7.4.4, 7.4.5 and 7.4.6 are affected.
2. Upgrade to FortiClient EMS 7.4.7 or later; if you rely on the 7.4.5/7.4.6 hotfix, confirm ems-webserver.conf contains RequestHeader unset lines for X-SSL-CLIENT-VERIFY and X-SSL-CLIENT-CERT.
3. Restrict the EMS web interface to management networks, and limit port 8013 to the address ranges your endpoints use.
4. Review Remote Access Profiles and endpoint policies for scripts you did not add, especially on_connect scripts, and remove them.
5. If you find compromise, restore EMS from a pre-compromise backup or rebuild it, rotate EMS admin credentials, API tokens and JWT secrets, and investigate every endpoint that received a rogue script.

### How to check if you are affected

- Search EMS logs for 'Certificate not found in request header.' followed by a fortinet-ca2 update, which Arctic Wolf saw during CVE-2026-35616 attacks.
- In Apache access logs, look for HTTP 500 responses or bursts of requests to /api/v1/init_consts and slow /api/v1/auth/signin responses (CVE-2026-21643).
- Look for new EMS admin accounts, logins from Tor exit nodes or VPS ranges, and changes to remind_upgrade_after.
- On endpoints, hunt for cmd.exe or powershell.exe launched by fortitray.exe or ipsec.exe, FortiEndpoint_Patch.exe, C:\ProgramData\log.txt, and traffic to 83.138.53.110.

## What happened

FortiClient EMS, the server that manages FortiClient agents, had two unauthenticated flaws in consecutive 7.4 releases, and attackers used both.

On February 6, 2026, Fortinet published [FG-IR-25-1142](https://fortiguard.fortinet.com/psirt/FG-IR-25-1142) for CVE-2026-21643, a SQL injection in EMS 7.4.4 that it found internally, and fixed it in 7.4.5. [Bishop Fox](https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4) showed that the `Site` header, which selects a tenant in multi-tenant mode, was pasted into a PostgreSQL query before login. The public `/api/v1/init_consts` endpoint returns database errors, so data can be pulled out quickly. In Fortinet's VM image, Bishop Fox reached OS command execution. [SecurityWeek](https://www.securityweek.com/exploitation-of-critical-fortinet-forticlient-ems-flaw-begins/) reported that Defused saw exploitation start in late March.

On April 4, Fortinet disclosed CVE-2026-35616 in [FG-IR-26-099](https://fortiguard.fortinet.com/psirt/FG-IR-26-099), an API authentication bypass in 7.4.5 and 7.4.6 that was already exploited. [watchTowr](https://watchtowr.com/resources/fortinet-forticlient-ems-zero-day-cve-2026-35616-active-exploitation-underway/) saw attacks from March 31. [Bishop Fox](https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-35616) traced the bug to EMS trusting a client-supplied `X-SSL-CLIENT-VERIFY` header as proof of certificate login. Fortinet shipped hotfixes, and the [7.4.7 release notes](https://docs.fortinet.com/document/forticlient/7.4.7/ems-release-notes/429894) list the bug as resolved. Fortinet rates both CVSS 3.1 9.8 (9.1 with temporal metrics). CISA added CVE-2026-35616 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616) on April 6 and CVE-2026-21643 on April 13.

## Who is affected

CVE-2026-21643 hits 7.4.4. Bishop Fox says only multi-tenant (Sites) deployments are exposed. CVE-2026-35616 hits 7.4.5 and 7.4.6. Versions 7.2 and 8.0 are not affected by either bug, and Fortinet fixed FortiClient Cloud and FortiSASE itself. Note the trap: upgrading from 7.4.4 to 7.4.5 closes the SQL injection but opens the API bypass. The safe target is 7.4.7 or later.

## Do you really need to act?

Patching is old news by now, but hunting is not. EMS can push configuration and scripts to every managed laptop, so a compromised server is a fleet-wide problem. [Arctic Wolf](https://arcticwolf.com/resources/blog-uk/forticlient-ems-exploited-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/) documented this in May 2026. Attackers used CVE-2026-35616 to log in from Tor exit nodes and add an `on_connect` script to a Remote Access Profile. When users connected to the VPN, the script ran a fake `FortiEndpoint_Patch.exe`, a browser credential stealer. No actor has been publicly named, and CISA lists ransomware use as unknown.

## What to do now

1. Record the version of every EMS server.
2. Upgrade to 7.4.7 or later. If you are relying on the hotfix, check it with `grep -i "RequestHeader unset" ems-webserver.conf` and expect entries for `X-SSL-CLIENT-VERIFY` and `X-SSL-CLIENT-CERT`.
3. Keep the EMS web interface on management networks, and restrict port 8013 to your endpoint ranges.
4. Audit Remote Access Profiles, endpoint policies and admin accounts for anything you did not create.
5. If compromised, restore or rebuild EMS, rotate admin credentials, API tokens and JWT secrets, and reset the browser-stored credentials of affected users.

## How to tell if you were hit

For CVE-2026-35616, Arctic Wolf saw the EMS log line `Certificate not found in request header.`, followed by a `fortinet-ca2` update. Also look for new admins, logins from Tor or VPS ranges, and changes to `remind_upgrade_after`. On endpoints, look for `fortitray.exe` or `ipsec.exe` spawning `cmd.exe` and `powershell.exe`, scripts under `FortiClient\logs\Trace\scripts\`, and connections to `83.138.53.110`. For CVE-2026-21643, Bishop Fox suggests looking for HTTP 500s or rapid repeats on `/api/v1/init_consts`. Also check PostgreSQL logs for `SET search_path` values that do not match `fcm_<name>`. Default Apache logs omit the `Site` header.

## Timeline

- Feb 6, 2026 — Fortinet discloses CVE-2026-21643 and fixes it in EMS 7.4.5.
- Mar 9, 2026 — Bishop Fox publishes its root-cause analysis.
- Mar 31, 2026 — watchTowr sees exploitation of the unknown API bypass, after Defused reported CVE-2026-21643 attacks days earlier.
- Apr 4, 2026 — Fortinet discloses CVE-2026-35616 and ships hotfixes for 7.4.5 and 7.4.6.
- Apr 6, 2026 — CISA adds CVE-2026-35616 to KEV, with a federal due date of April 9.
- Apr 13, 2026 — CISA adds CVE-2026-21643 to KEV, with a federal due date of April 16.
- May 27, 2026 — Arctic Wolf reports EMS abuse delivering the EKZ infostealer.

## Sources

1. [Fortinet PSIRT — FG-IR-25-1142: SQLi in administrative interface (CVE-2026-21643)](https://fortiguard.fortinet.com/psirt/FG-IR-25-1142)
2. [Fortinet PSIRT — FG-IR-26-099: API authentication and authorization bypass (CVE-2026-35616)](https://fortiguard.fortinet.com/psirt/FG-IR-26-099)
3. [Fortinet — FortiClient EMS 7.4.7 release notes: resolved issues](https://docs.fortinet.com/document/forticlient/7.4.7/ems-release-notes/429894)
4. [CVE record — CVE-2026-21643](https://www.cve.org/CVERecord?id=CVE-2026-21643)
5. [CVE record — CVE-2026-35616](https://www.cve.org/CVERecord?id=CVE-2026-35616)
6. [NVD — CVE-2026-21643](https://nvd.nist.gov/vuln/detail/CVE-2026-21643)
7. [NVD — CVE-2026-35616](https://nvd.nist.gov/vuln/detail/CVE-2026-35616)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-35616](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616)
9. [CISA — Known Exploited Vulnerabilities: CVE-2026-21643](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643)
10. [Bishop Fox — CVE-2026-21643: Pre-authentication SQL injection in FortiClient EMS 7.4.4](https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4)
11. [Bishop Fox — API authentication bypass in FortiClient EMS 7.4.5-7.4.6 (CVE-2026-35616)](https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-35616)
12. [Arctic Wolf — FortiClient EMS exploited via CVE-2026-35616 to deliver EKZ Infostealer](https://arcticwolf.com/resources/blog-uk/forticlient-ems-exploited-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/)
13. [watchTowr — FortiClient EMS zero-day CVE-2026-35616: active exploitation underway](https://watchtowr.com/resources/fortinet-forticlient-ems-zero-day-cve-2026-35616-active-exploitation-underway/)
14. [SecurityWeek — Exploitation of critical Fortinet FortiClient EMS flaw begins](https://www.securityweek.com/exploitation-of-critical-fortinet-forticlient-ems-flaw-begins/)
15. [Help Net Security — FortiClient EMS zero-day exploited, emergency hotfixes available](https://helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616)

---
Source page: https://erroneo.us/security/briefs/forticlient-ems-cve-2026-21643-35616-unauth-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt