CVE-2026-59836 is a high severity (CVSS 7.5) improper certificate validation flaw in Fortinet FortiClientEMS 7.4.0 through 7.4.5 and all of 7.2. Fortinet says upgrade 7.4 to 7.4.6 or above and migrate 7.2 to a fixed release. FortiClientEMS 8.0 is not affected.
What's affected
- FortiClientEMS 7.4.3 through 7.4.5: upgrade to 7.4.6 or above.
- FortiClientEMS 7.4.0 through 7.4.1: upgrade to 7.4.6 or above.
- FortiClientEMS 7.2, all versions: migrate to a fixed release.
- FortiClientEMS 8.0: not affected.
- Weakness: CWE-295, improper certificate validation. CVSS 7.5, vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
The record's own description ends with an unfilled template placeholder for the attack vector, so use the Fortinet advisory for the details. It describes a missed certificate verification in AD Connector communication, where a remote attacker with a valid API key could impersonate an AD Connector. Fortinet rates it Medium and lists known exploited as No.
How to check if you're exposed
Check the FortiClientEMS version in the product's about or system information page, then compare it with the list above. Note that the advisory table gives 7.4.0 through 7.4.1 and 7.4.3 through 7.4.5 as affected, and 7.4.2 is not listed, so read the PSIRT page for your exact build.
Also find out whether you use the Active Directory connector at all, since the issue sits in that communication path. Your Fortinet account or support portal shows your deployed EMS version and entitlement.
What to do now
- Find every FortiClientEMS server and note its version.
- Upgrade 7.4 installs to 7.4.6 or above.
- For 7.2, plan the migration to a fixed release. Fortinet gives no patch within 7.2.
- If you use the AD Connector, review the API keys it holds and rotate them as part of the upgrade.
- Limit network access to the EMS server to the clients and admins that need it.
Why it matters
Certificate validation is what tells a client it is talking to the real server. When that check is missed, the other side can be a stand in. In this case the advisory describes a missed verification in the AD Connector link, so an impostor with a valid API key could pose as the connector.
It is a CWE-295 weakness. Fortinet rates it Medium and says it is not known exploited, and the record's KEV flag is false. Still, a management server that touches endpoints and directory data deserves a prompt update.
Quick check
Is FortiClientEMS 8.0 affected?
No. The Fortinet advisory lists 8.0 as not affected.
Is it known to be exploited?
The advisory says known exploited: No, and the KEV flag is false.
Sources
Last reviewed: 19 October 2026.
