keraattin/CVE-2026-35616

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based vulnerability scanner for CVE-2026-35616 that detects an authentication bypass in FortiClient EMS by comparing HTTP response codes from baseline and header-spoofed requests. It does not exploit the vulnerability to execute code or commands.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python vulnerability scanner and a README documentation file for CVE-2026-35616. The Python script performs only safe, non-exploitative HTTP requests to detect an authentication bypass vulnerability. It sends baseline and spoofed-header requests and compares HTTP status codes. No backdoor, trojan, or deceptive payload is present. The script does not execute commands, establish persistence, exfiltrate data, or contact attacker-controlled infrastructure. The README provides documentation and manual verification instructions using curl, which are standard for PoC disclosure.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareFortiClient EMS
Attack typesauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is to detect the presence of CVE-2026-35616 by sending crafted HTTP requests and analyzing differential responses. It does not contain code to exploit the vulnerability for unauthorized code execution, privilege escalation, or command injection. The README explicitly states 'No exploitation payload is ever sent. The test is safe for production.'

CVE-2026-35616_FortiClientEMS_detector.py:142-150README.md:200-207

Requirements

  • Network access to a target FortiClient EMS instance on a specified port (default 443).CVE-2026-35616_FortiClientEMS_detector.py:77-82

Observed behavior

  • Sends a baseline POST request to API endpoints without spoofed headers and records the HTTP status code.CVE-2026-35616_FortiClientEMS_detector.py:180-201
  • Sends a second POST request with spoofed X-SSL-CLIENT-VERIFY, X-SSL-CLIENT-S-DN, and X-SSL-CLIENT-SERIAL headers and records the HTTP status code.CVE-2026-35616_FortiClientEMS_detector.py:203-227
  • Compares the two status codes; if the baseline returns 401 and the spoofed request returns a different code (e.g., 500, 200), the target is flagged as vulnerable.CVE-2026-35616_FortiClientEMS_detector.py:229-244
  • Outputs a human-readable or JSON report indicating whether the target is likely vulnerable, without performing any exploitation or code execution.CVE-2026-35616_FortiClientEMS_detector.py:251-312
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
Sends HTTP POST requests to target FortiClient EMS API endpoints with and without spoofed X-SSL-CLIENT-VERIFY headersThis is the core detection logic for CVE-2026-35616. It is explicitly described in the script's docstring and README, and is consistent with safe vulnerability scanning.CVE-2026-35616_FortiClientEMS_detector.py:142-248README.md:196-206
Author Identity
Kerem Oruç (GitHub: @keraattin, Twitter: @keraattin)The author is identified in both files. This is standard attribution for a public PoC and does not indicate malicious intent.CVE-2026-35616_FortiClientEMS_detector.py:24-26README.md:391-396
Review boundaries

What the analysis did not establish

  • One file (likely the Nmap NSE script mentioned in the README) is omitted from the evidence, but the provided Python scanner is complete and sufficient for classification.
  • The evidence does not include the actual execution output of the scanner; classification is based solely on static analysis of the source code.
  • One file (CVE-2026-35616_FortiClientEMS.nse) was present in the repository but was not included as readable text; only its metadata was provided. Its content was not reviewed.
  • The evidence does not include runtime behavior or network traffic captures; analysis is based solely on static source code review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1