CVE-2026-35616 — Fortinet FortiClient EMS Improper Access Control Exploitation

union
(
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where DeviceVendor =~ "Fortinet"
    | where DeviceProduct has_any ("FortiClient", "EMS", "FortiClient EMS")
    | where Activity has_any ("access denied", "authorization failure", "improper access", "privilege escalation", "unauthorized", "access control bypass")
    | project TimeGenerated, DeviceVendor, DeviceProduct, Activity, SourceIP, DestinationIP, DestinationPort, RequestURL, AdditionalExtensions, Message
),
(
    DeviceEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any ("FortiEMSAgent", "fcems", "fcemsvc")
    | where ActionType has_any ("ProcessCreated", "NetworkConnectionInspected", "RegistryValueSet")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, RemoteIP, RemotePort, RegistryKey
),
(
    AzureActivity
    | where TimeGenerated > ago(7d)
    | where Properties has "FortiClient"
    | where ActivityStatus =~ "Failed"
    | project TimeGenerated, Caller, CallerIpAddress, OperationName, ResourceGroup, ActivityStatus, Properties
)
| sort by TimeGenerated desc

index=* (sourcetype="fortinet:forticlient" OR sourcetype="fortinet:ems" OR sourcetype="syslog" host="*ems*")
| eval normalized_msg=lower(coalesce(message, _raw))
| where match(normalized_msg, "(access.denied|authorization.fail|privilege.escal|unauthorized|bypass|improper.access|access.control)")
OR (match(normalized_msg, "(forticlient|fcems|ems)") AND match(normalized_msg, "(error|fail|denied|reject)"))
| eval severity_indicator=case(
    match(normalized_msg, "privilege.escal"), "CRITICAL",
    match(normalized_msg, "bypass|unauthorized"), "HIGH",
    match(normalized_msg, "access.denied|authorization.fail"), "MEDIUM",
    true(), "LOW"
  )
| stats count AS event_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(src_ip) AS source_ips, values(dest_ip) AS dest_ips, values(severity_indicator) AS severity_indicators BY host, user, normalized_msg
| where event_count > 1
| sort - event_count

sequence by host.name with maxspan=10m
  [network where process.name : ("fcems*", "FortiEMS*", "fcemsvc*") and
   (network.direction == "ingress" or network.direction == "inbound") and
   destination.port in (8013, 8014, 443, 10443)]
  [any where
   (event.outcome == "failure" or event.action in ("access-denied", "authorization-failure", "privilege-escalation")) and
   (process.name : ("fcems*", "FortiEMS*") or host.name : ("*ems*", "*forticlient*"))
  ]

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  qid,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source,
  "EventID",
  magnitude,
  UTF8(payload) AS raw_payload
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%fortinet%'
  AND (
    LOWER(UTF8(payload)) ILIKE '%forticlient%' OR
    LOWER(UTF8(payload)) ILIKE '%ems%'
  )
  AND (
    LOWER(UTF8(payload)) ILIKE '%access denied%' OR
    LOWER(UTF8(payload)) ILIKE '%authorization fail%' OR
    LOWER(UTF8(payload)) ILIKE '%improper access%' OR
    LOWER(UTF8(payload)) ILIKE '%privilege escalat%' OR
    LOWER(UTF8(payload)) ILIKE '%bypass%'
  )
  AND starttime > NOW() - 7 DAYS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=fortinet* OR _sourceCategory=*ems* OR _sourceCategory=*forticlient*
| parse regex "(?i)(?P<event_type>access denied|authorization fail|privilege escal|unauthorized|bypass|improper access)" nodrop
| parse regex "src=(?P<src_ip>[\d\.]+)" nodrop
| parse regex "dst=(?P<dst_ip>[\d\.]+)" nodrop
| parse regex "user=(?P<username>\S+)" nodrop
| where !isNull(event_type)
| timeslice 5m
| stats count AS event_count, values(src_ip) AS source_ips, values(event_type) AS event_types BY _timeslice, username, _sourceHost
| where event_count > 2
| sort by event_count desc

rule cve_2026_35616_forticlient_ems_access_control {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-35616 — Fortinet FortiClient EMS Improper Access Control exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://fortiguard.fortinet.com/psirt/FG-IR-26-099"
    cve = "CVE-2026-35616"
  events:
    $e.metadata.vendor_name = /(?i)fortinet/
    $e.metadata.product_name = /(?i)(forticlient|ems|enterprise management)/
    (
      $e.metadata.event_type = "NETWORK_CONNECTION" or
      $e.metadata.event_type = "USER_LOGIN" or
      $e.metadata.event_type = "STATUS_UPDATE"
    )
    (
      $e.security_result.action = "BLOCK" or
      $e.security_result.action = "DENY" or
      $e.security_result.description = /(?i)(access denied|authorization fail|privilege escalat|unauthorized|bypass|improper access)/
    )
    $e.principal.ip != ""
  match:
    $e.principal.ip over 15m
  condition:
    #e >= 3
}

#event_simpleName = NetworkConnectIP4 OR ProcessRollup2 OR DnsRequest
| $process_name_lower = lowercase(ImageFileName)
| $cmdline_lower = lowercase(CommandLine)
| filter(
    ($process_name_lower CONTAINS "fcems" OR $process_name_lower CONTAINS "fortiems" OR $process_name_lower CONTAINS "forticlient")
    OR ($cmdline_lower MATCHES ".*ems.*access.*denied.*" OR $cmdline_lower MATCHES ".*forticlient.*unauthori.*")
    OR (RemotePort IN [8013, 8014, 10443] AND $process_name_lower CONTAINS "forti")
  )
| groupBy([ComputerName, UserName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort], function=count(1, as=event_count))
| sort(event_count, order=desc)
| limit 200