NCSC-2026-0243 [1.00] [M/H] Vulnerability fixed in Fortinet FortiClient EMS
Fortinet has fixed a vulnerability in FortiClient EMS versions 7.2 to 7.4.5. The vulnerability concerns improper validation of certificates within FortiClient EMS. This allows an external, unauthenticated attacker to impersonate an Active Directory Connector by using a valid API key. Exploitation of this vulnerability may lead to unauthorized information leaks.
CSIRTS triage
- What
- Improper validation of certificates allows an attacker to impersonate an Active Directory Connector.
- Who is affected
- Deployments of FortiClient EMS versions 7.2 to 7.4.5 are affected.
- Urgency
- Remediation is urgent due to the potential for unauthorized information leaks.
- Action
- Update FortiClient EMS to the latest version to mitigate this vulnerability.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch FortiClient EMS
Get an email when a new FortiClient EMS advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0243
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-598360.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-59836 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] Fortinet FortiClient EMS: Vulnerability allows bypassing security measurescert-bund
- unknownMultiple vulnerabilities in Fortinet products (July 15, 2026)cert-fr-avis
- highCVE-2026-59836: A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5…nvd
- unknownMissed certificate verification in AD Connector communication with FortiClient EMSfortinet
Recent advisories for Fortinet FortiClient EMS
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- medium[NEW] [medium] Fortinet FortiClient EMS: Vulnerability allows bypassing security measurescert-bund · 2026-07-15
- criticalexploitedCVE-2026-21643: Fortinet FortiClient EMS SQL Injection Vulnerabilitycisa-kev · 2026-04-13
- criticalexploitedCVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerabilitycisa-kev · 2026-04-06
- criticalexploitedCVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerabilitycisa-kev · 2024-03-25
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30