FortiClient EMS CVE-2026-35616 unauthenticated admin API access via port 8013
Detects network requests targeting port 8013 that generate an error message indicating a missing certificate in the request header. This pattern is associated with attempts to exploit vulnerability CVE-2026-35616.
Microsoft Sentinel (KQL)

