{"document": {"title": "API authentication and authorization bypass", "category": "Fortinet PSIRT Advisories", "csaf_version": "2.0", "publisher": {"category": "vendor", "contact_details": "https://fortiguard.fortinet.com/faq/psirt-contact", "issuing_authority": "Fortinet PSIRT", "name": "Fortinet PSIRT", "namespace": "https://fortiguard.fortinet.com/psirt"}, "tracking": {"id": "FG-IR-26-099", "current_release_date": "2026-07-08T00:00:00", "initial_release_date": "2026-04-04T00:00:00", "revision_history": [{"number": "1", "date": "2026-04-04T00:00:00", "summary": "Initial Publication"}], "status": "final", "version": "0"}, "acknowledgments": [{"summary": "Fortinet is pleased to thank Simo Kohonen from Defused and Nguyen Duc Anh for reporting this vulnerability under responsible disclosure."}]}, "product_tree": {"branches": [{"category": "vendor", "name": "Fortinet PSIRT", "branches": [{"category": "product", "name": "FortiClientEMS", "branches": [{"category": "product_version_range", "name": "FortiClientEMS/ 8.0 all versions", "product": {"product_id": "FortiClientEMS/ 8.0 all versions", "name": "FortiClientEMS"}}, {"category": "product_version_range", "name": "FortiClientEMS/>=7.4.5|<=7.4.6", "product": {"product_id": "FortiClientEMS >=7.4.5|<=7.4.6", "name": "FortiClientEMS"}}, {"category": "product_version_range", "name": "FortiClientEMS/ 7.2 all versions", "product": {"product_id": "FortiClientEMS/ 7.2 all versions", "name": "FortiClientEMS"}}]}]}]}, "vulnerabilities": [{"cve": "CVE-2026-35616", "cwe": {"id": "CWE-284", "name": "Improper Access Control"}, "title": "FortiClientEMS - CRITICAL - FG-IR-26-099", "scores": [{"products": ["FortiClientEMS"], "cvss_v3": {"version": "3.1", "baseScore": 9.1, "baseSeverity": "CRITICAL", "temporalScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"}}], "notes": [{"category": "summary", "title": "Summary", "text": "Improper Access Control in FortiClient EMS.\n\n"}, {"category": "general", "title": "Additional info", "text": "Fortinet remediated this issue in FortiClient Cloud and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSASE and hence customers do not need to perform any action."}], "product_status": {"known_affected": ["FortiClientEMS >=7.4.5|<=7.4.6"], "known_not_affected": ["FortiClientEMS/ 8.0 all versions", "FortiClientEMS-7.4.7", "FortiClientEMS/ 7.2 all versions"]}, "threats": [{"category": "impact", "details": "Escalation of privilege"}], "remediations": [{"details": "FortiClientEMS 8.0: Not Applicable\nFortiClientEMS 7.4: Upgrade to 7.4.7 or above\nFortiClientEMS 7.2: Not Applicable", "category": "vendor_fix", "product_ids": ["FortiClientEMS"]}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-099", "summary": "An Improper Access Control vulnerability [CWE-284] in FortiClient EMS may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.\n\nFortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6, by following the instructions at:\n \nhttps://docs.fortinet.com/document/forticlient/7.4.5/ems-release-notes/832484  - for FortiClientEMS 7.4.5\n \nhttps://docs.fortinet.com/document/forticlient/7.4.6/ems-release-notes/832484 - for FortiClientEMS 7.4.6\n\nUpcoming FortiClientEMS 7.4.7 will also include a fix for this issue. In the meantime the hotfix above is sufficient to prevent it entirely."}]}]}