FortiClient EMS CVE-2026-35616 API Auth Bypass on Port 8013

Ibrahim Saud@tektrix

•updated Jul 3, 2026•9•0•55

Detects anomalous network traffic patterns targeting FortiClient EMS systems, specifically on port 8013. This pattern is indicative of exploitation attempts related to CVE-2026-35616, where an external entity communicates with a vulnerable FortiClient EMS instance multiple times in a short window.