CVE-2026-35616 - FortiClient EMS Pre-Authentication API Bypass (CVSS 9.1, CISA KEV). Python & Nmap NSE detection scripts with full technical breakdown. One forged HTTP header bypasses authentication on FortiClient EMS 7.4.5–7.4.6, granting full admin API access to all managed endpoints.
cybersecurity vulnerability-detection fortinet nmap-scripts authentication-bypass vulnerability-research forticlient nse-scripts cve-2026-35616 forticlient-ems
-
Updated
Apr 13, 2026 - Python