CVE-2026-35616 FortiClient EMS Unauthenticated Admin API Access Attempt

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•8

This rule detects attempts to exploit an unauthenticated administration API vulnerability (CVE-2026-35616) in FortiClient EMS versions 7.4.5 and 7.4.6, commonly referred to as FortiBleed. This vulnerability could allow an unauthenticated attacker to gain unauthorized access to the administration interface.