π¨ New Fortinet vulnerability being exploited as an 0-day
CVE-2026-35616 - FortiClient EMS pre-authentication API access bypass - CVSS 9.1 Critical
After observing in-the-wild exploitation of this vulnerability earlier this week, Defused reported it to Fortinet under responsible disclosure.
Fortinet has released an emergency hotfix - plus a scheduled patch - for FortiClient EMS 7.4.5 and 7.4.6.
The vulnerability allows an unauthenticated attacker to bypass API authentication and authorization entirely, unauthorized code or commands via crafted requests.
This discovery was made through our upcoming Radar feature launching next week π
Advisory: https://t.co/Jr2fUbq8JV
Track exploitation of this and other Fortinet vulns in real time and get updates on the new Defused Radar π https://t.co/iRDhHlDkep
Credit also to @heckintosh_ for independently discovering this vulnerability πͺ
Past few weeks I have been posting less @DefusedCyber updates, but only because it's reached enough users that have needed to rework some scaling aspects.
That said, new stuff coming soon again π
Shame we didn't pick up on this sooner despite the data being in the platform, but showcases exactly why I'm launching @DefusedCyber Builder - you can pick up different things & sometimes get earlier signals from running honeypots on your own infra π―
π¨ Based on @rapid7 observations of exploitation of PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257), we can also confirm first signs of exploitation around the same time (May 18th on the Defused TF feeds, and a customer hit on May 17th)
The exploit payload differs slightly from Rapid 7's POC with the user-agent PAN GlobalProtect/6.0.0
Attacker IP: 104.207.144[.]154 πΊπΈ AS20473 The Constant Company
Rapid7 write-up: https://t.co/n9QiTULwHA
@adversarialy@techspence Yeah i looked at it at some point. Its a good idea in principle but has some pitfalls (at least for Defused specifically) and i have gone a different route IRT ai assisted honeypotting