CVE-2026-35616 FortiClient EMS API auth bypass exploitation

Ibrahim Saud@tektrix

•updated Jul 3, 2026•8•0•39

This rule detects potential exploitation attempts targeting vulnerabilities in FortiClient EMS. It specifically looks for indicators such as requests lacking proper certificate headers or suspicious requests to 'service/save.php' on the FortiClient EMS server, which are commonly associated with CVE-2026-35616.