CVE-2026-59836
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability in Fortinet FortiClientEMS allows an attacker to disclose information due to improper certificate validation. Affected versions include 7.4.3-7.4.5, 7.4.0-7.4.1, and all 7.2 versions.
Risk Assessment
An attacker could exploit this flaw to intercept sensitive data transmitted between the client and server, leading to a breach of information confidentiality within the organization.
Recommendation
It is recommended to immediately upgrade FortiClientEMS to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in FortiClientEMS
See all- CVE-2025-59922High
An SQL Injection vulnerability in Fortinet FortiClientEMS allows an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP/HTTPS requests.
- CVE-2026-35616CriticalActively exploited
An improper access control vulnerability in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
- CVE-2023-47534Critical
An improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiClientEMS across multiple versions. It allows an attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2026-39810Medium
FortiClientEMS versions 7.4.0 through 7.4.5 contain a hard-coded cryptographic key. An attacker can use this key to decrypt a database dump and disclose information.
- CVE-2023-45581High
An improper privilege management vulnerability (CWE-269) in Fortinet FortiClientEMS allows a site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests.
Original NVD description (English source)
A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS