CVE-2026-35616 FortiClient EMS admin API exploitation via port 8013

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•12

Detects potential exploitation attempts against FortiClient EMS versions 7.4.5-7.4.6, specifically targeting the administration API on port 8013. The detection identifies unauthorized access attempts indicated by the log entry 'Certificate not found in request header', which correlates with exploit behavior for CVE-2026-35616.