FortiClient EMS Management Interface Anomaly (CVE-2026-35616 Exploitation Indicators)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•3

This rule detects network connections to external (non-private) IP addresses on port 8013. Additionally, it identifies potential anomalies where a network request on this port contains a message indicating that the required certificate was not found in the HTTP request header, which may indicate unauthorized or malicious activity, such as C2 communication attempt over non-standard ports or communication bypass.