FortiClient EMS CVE-2026-35616 Exploitation Indicators

Ibrahim Saud@tektrix

•updated Jul 3, 2026•4•0•6

Detects potential exploitation attempts of CVE-2026-35616 targeting Fortinet FortiClient EMS versions 7.4.5 and 7.4.6. The rule identifies suspicious indicators such as API authentication bypass attempts marked by missing certificate headers, unauthorized modifications to remote access VPN profiles, and unauthenticated administrative API access on port 8013.