Missed certificate verification in AD Connector communication with FortiClient EMS

CSIRTS triage

What

A remote unauthenticated attacker may impersonate an AD Connector via a valid API Key.

Who is affected

Users of FortiClient EMS with AD Connector integration.

Urgency

Remediation is critical to prevent impersonation attacks.

Action

Ensure proper certificate validation is implemented.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Fortinet FortiGuard PSIRT (INTL · vendor-psirt · site)

Severity

unknown

Published

2026-07-14

Exploitation

Not in CISA KEV at last sync

Original advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-147

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-598360.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownNCSC-2026-0243 [1.00] [M/H] Vulnerability fixed in Fortinet FortiClient EMSncsc-nl
• medium[NEW] [medium] Fortinet FortiClient EMS: Vulnerability allows bypassing security measurescert-bund
• unknownMultiple vulnerabilities in Fortinet products (July 15, 2026)cert-fr-avis
• highCVE-2026-59836: A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5…nvd

More from Fortinet FortiGuard PSIRT

• unknownHeader injection in captive portal authentication form2026-07-14
• unknownBuffer overread in authd and wad daemon2026-07-14
• unknownStack Buffer Overflow in Log Report2026-07-14
• unknownOut of bounds read in GUI2026-07-14
• unknownUnauthenticated VNC access exposed on all interfaces2026-07-14