A public proof-of-concept (PoC) for CVE-2026-35616, a critical authentication and authorization bypass in Fortinet FortiClient Endpoint Management Server (EMS), allows defenders to test whether affected systems are exposed. The flaw permits unauthenticated access to protected API endpoints. Fortinet has confirmed that the vulnerability has been exploited in the wild, making prompt patching of organizations running affected versions a priority.

In practical terms, a remote user without valid credentials can send crafted requests that bypass protections on the EMS API and execute unauthorized code or commands. The risk is serious because EMS manages FortiClient deployments, potentially giving an attacker access to a central endpoint-administration system. Proof of Concept (PoC) Released for FortiClient EMS Vulnerability This issue impacts FortiClient EMS versions 7.4.5 through 7.4.6.

The GitHub repository shared by Alaatk includes a Python script and instructions for running it against a specified host, which is relevant for security teams validating their own systems. FortiClient EMS Authentication Bypass PoC (Source: Alaatk | GitHub) Fortinet's advisory serves as the key reference for remediation. Organizations should restrict access to the EMS management interface to authorized networks, review logs for unusual API requests or unexpected changes, and investigate signs of unauthorized activity.

For additional context, see ZeroOwl's coverage of the FortiClient EMS zero-day and emergency hotfix, and their report on exposed FortiClient EMS instances.