A improper access control vulnerability in Fortinet FortiClientEMS 7

# check-forticlientems-cve-2026-35616.ps1

# Purpose: Determine likely exposure to CVE-2026-35616 on a Windows FortiClient EMS host

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-UninstallEntries {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $items = foreach ($p in $paths) {
        Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
            Where-Object {
                ($_.DisplayName -match 'FortiClient\s*EMS') -or
                ($_.Publisher -match 'Fortinet') -and ($_.DisplayName -match 'EMS')
            } |
            Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation, PSPath
    }

    $items | Sort-Object DisplayName -Unique
}

function Parse-Version([string]$v) {
    if ([string]::IsNullOrWhiteSpace($v)) { return $null }
    $clean = ($v -replace '[^0-9\.]','').Trim('.')
    if ([string]::IsNullOrWhiteSpace($clean)) { return $null }
    $parts = $clean.Split('.') | Where-Object { $_ -ne '' }
    $ints = @()
    foreach ($p in $parts) {
        try { $ints += [int]$p } catch { $ints += 0 }
    }
    return ,$ints
}

function Compare-VersionArrays($a, $b) {
    # returns -1 if a<b, 0 if equal, 1 if a>b

    $len = [Math]::Max($a.Count, $b.Count)
    for ($i = 0; $i -lt $len; $i++) {
        $av = if ($i -lt $a.Count) { [int]$a[$i] } else { 0 }
        $bv = if ($i -lt $b.Count) { [int]$b[$i] } else { 0 }
        if ($av -lt $bv) { return -1 }
        if ($av -gt $bv) { return 1 }
    }
    return 0
}

function Version-StartsWith($arr, $prefix) {
    if ($arr.Count -lt $prefix.Count) { return $false }
    for ($i = 0; $i -lt $prefix.Count; $i++) {
        if ([int]$arr[$i] -ne [int]$prefix[$i]) { return $false }
    }
    return $true
}

$entries = Get-UninstallEntries
if (-not $entries -or $entries.Count -eq 0) {
    Write-Output 'UNKNOWN: No FortiClient EMS uninstall entry found in standard registry locations.'
    exit 2
}

# Prefer the entry with a version value

$entry = $entries | Where-Object { $_.DisplayVersion } | Select-Object -First 1
if (-not $entry) { $entry = $entries | Select-Object -First 1 }

$rawVersion = $entry.DisplayVersion
$ver = Parse-Version $rawVersion

if (-not $ver) {
    Write-Output ('UNKNOWN: Found {0} but could not parse DisplayVersion "{1}".' -f $entry.DisplayName, $rawVersion)
    exit 2
}

# Known fixed milestones from Fortinet docs:

# 7.4.5.2111.1277073  (GA hotfix 1)

# 7.4.6.2170.1277073  (GA hotfix 1)

# 7.4.7+              (general fixed release)

$prefix745 = @(7,4,5)
$prefix746 = @(7,4,6)
$prefix747 = @(7,4,7)
$fix745    = @(7,4,5,2111)
$fix746    = @(7,4,6,2170)

$status = $null
$reason = $null

if (Version-StartsWith $ver $prefix745) {
    if ((Compare-VersionArrays $ver $fix745) -ge 0) {
        $status = 'PATCHED'
        $reason = '7.4.5 with hotfix build >= 2111 detected.'
    } else {
        $status = 'VULNERABLE'
        $reason = '7.4.5 detected without GA hotfix 1 build threshold.'
    }
}
elseif (Version-StartsWith $ver $prefix746) {
    if ((Compare-VersionArrays $ver $fix746) -ge 0) {
        $status = 'PATCHED'
        $reason = '7.4.6 with hotfix build >= 2170 detected.'
    } else {
        $status = 'VULNERABLE'
        $reason = '7.4.6 detected without GA hotfix 1 build threshold.'
    }
}
elseif ((Compare-VersionArrays $ver $prefix747) -ge 0) {
    $status = 'PATCHED'
    $reason = 'Version is 7.4.7 or later.'
}
else {
    $status = 'UNKNOWN'
    $reason = 'Installed version is outside the directly documented affected range in this check.'
}

Write-Output ('Product      : {0}' -f $entry.DisplayName)
Write-Output ('Version      : {0}' -f $rawVersion)
Write-Output ('Install Path : {0}' -f $entry.InstallLocation)
Write-Output ('Result       : {0}' -f $status)
Write-Output ('Reason       : {0}' -f $reason)

switch ($status) {
    'PATCHED'    { exit 0 }
    'VULNERABLE' { exit 1 }
    default      { exit 2 }
}