CTI Submission: https://bishopfox.com/blog/api-authentication-bypa...

[letswastetimee]

CTI Content

✅ Content successfully downloaded and saved to file.

Content Preview:

CVE-2026-35616 is an authentication bypass inFortiClient EMS 7.4.5 and 7.4.6.The Django authentication middleware accepts client certificate information from both trusted WSGI environment variables (set by Apachemod_ssl) and user-controllable HTTP request headers, and Apache was never configured to strip the user-controllable variants. An attacker who can reach the EMS web interface over HTTPS needs no credentials to exploit this. Additionally, the certificate chain validation performs only Dist...

Full content length: 14,114 characters
Saved to: .hearth/intel-drops/issue-257-cti.txt

The full content has been downloaded and will be processed automatically.

Link to Original Source

https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-35616

Your Name / Handle

smossmos

Link to Profile (Optional)

https://github.com/smossmos

[letswastetimee]

✅ A new hunt has been drafted from your submission! (Attempt 1/5)

Hypothesis: Threat actors are injecting HTTP headers X-SSL-CLIENT-VERIFY with value "SUCCESS" and X-SSL-CLIENT-CERT containing forged certificate chains to bypass authentication on FortiClient EMS web interfaces listening on port 443, gaining unauthorized API access to endpoint management functions.

Please review the updated file here:
View Hunt Draft

---

🔍 Duplicate Detection Results:
⚠️ Legacy duplicate detection not available.

---

If you want to regenerate, please leave a comment on this issue with your feedback or what you'd like changed, then add the regenerate label.

If it looks good, add the approved label.

[letswastetimee]

🚀 Your submission has been approved and a pull request has been created. Thank you!
🔗 View PR: #258