FortiClient and EMS
CVE-2024-32119: Improper authentication in FortiClientEMS
An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiClientEMS 7.4 | 7.4.1 or later |
| FortiClientEMS 7.2.0 to 7.2.4 | 7.2.5 or later |
| FortiClientEMS 7.0.0 to 7.0.13 | Upgrade past 7.0.13; see the advisory |
| FortiClientEMS 6.4.7 to 6.4.9 | Upgrade past 6.4.9; see the advisory |
| FortiClientEMS 6.4.0 to 6.4.4 | Upgrade past 6.4.4; see the advisory |
| FortiClientEMS 6.2.6 to 6.2.9 | Upgrade past 6.2.9; see the advisory |
| FortiClientEMS 6.2.0 to 6.2.4 | Upgrade past 6.2.4; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.