CVE-2026-59836
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Fortinet FortiClientEMS allows an attacker to disclose information due to improper certificate validation. Affected versions include 7.4.3-7.4.5, 7.4.0-7.4.1, and all 7.2 versions.
Risk Assessment
An attacker could exploit this flaw to intercept sensitive data transmitted between the client and server, leading to a breach of information confidentiality within the organization.
Recommendation
It is recommended to immediately upgrade FortiClientEMS to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in FortiClientEMS
See all- CVE-2025-59922High
An SQL Injection vulnerability in Fortinet FortiClientEMS allows an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP/HTTPS requests.
- CVE-2026-35616CriticalActively exploited
An improper access control vulnerability in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Original NVD description (English source)
A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>