Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-35616 & CVE-2026-21643 – Fortinet FortiClientEMS: Overview & Takeaways

netspi.com | vulnerability | #rce | #sqli | #cve-2026-35616 | #fortinet | #cve-2026-21643 | #in-the-wild | #auth-bypass | #forticlientems

Summary

Two actively exploited FortiClientEMS flaws: CVE-2026-35616, an unauthenticated API auth bypass to RCE in 7.4.5/7.4.6, and CVE-2026-21643, SQLi limited to 7.4.4 multi-tenant deployments.
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways
The wp2shell chain pairs REST API route confusion (CVE-2026-63030) with WP_Query SQL injection (CVE-2026-60137) for unauthenticated full RCE on WordPress Core, now actively exploited in the wild.
vulnerability · netspi.com
CVE-2026-41940 cPanel & WHM Authentication Bypass Overview and Takeaways
CVE-2026-41940 (CVSS 9.8) is an authentication bypass in cPanel & WHM and WP Squared that injects values into server-side session files for root-level access, and was exploited before the patch.
Critical · vulnerability · bishopfox.com
API Authentication Bypass in FortiClient EMS 7.4.5-7.4.6–CVE-2026-35616
CVE-2026-35616: FortiClient EMS 7.4.5-7.4.6 trusts spoofable headers as cert auth and skips signature checks, letting attackers forge certificates for API access; exploited in the wild.
Critical · vulnerability · bishopfox.com
Pre-Authentication SQL Injection in FortiClient EMS 7.4.4 - CVE-2026-21643
Pre-auth CVE-2026-21643 exploitation: /api/v1/init_consts leaks database errors with no lockout, letting attackers extract admin credentials and endpoint data from multi-tenant FortiClient EMS 7.4.4.
vulnerability · netspi.com
“StyleSmuggler” – Adobe Commerce, Adobe Commerce B2B, and Magento RCE (CVE-2026-75650): Overview and Takeaways
CVE-2026-75650 (CVSS 10.0) lets unauthenticated attackers inject PHP through Magento's email template engine for RCE, with in-the-wild exploitation and Rust backdoors confirmed before the hotfix.
vulnerability · netspi.com
Splunk Enterprise Unauthenticated Arbitrary File Operations/RCE (CVE-2026-20253): Overview and Takeaways
CVE-2026-20253 (CVSS 9.8) exposes an unauthenticated PostgreSQL sidecar endpoint in Splunk Enterprise 10.0.x/10.2.x, allowing file writes that chain to RCE via lo_export; a public PoC exists.
back