CVE-2026-43616

CVEs › CVE-2026-43616

Description

Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences or absolute paths. Attackers can exploit insufficient path normalization during archive extraction to write files outside the intended extraction directory and achieve persistent code execution by overwriting user startup scripts.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: MEDIUM
CVSS score: 6.8 / 10
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Effective score: 6.8 / 10 MEDIUM source: CNA overview
CWE(s): CWE-23
Reserved: 2026-05-01
Published: 2026-05-04 19:33 UTC
Last updated: 2026-05-04 21:39 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/43xxx/CVE-2026-43616.json
Linked Threat: CVE-2026-43616 — CVE-2026-43616

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

EPSS score: 0.0002 (probability of exploitation in next 30 days)
EPSS percentile: 5.57% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD / KEV / EPSS data refreshed 2026-05-25 08:49 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-27081
Assigner: VulnCheck
Published: May 4, 2026, 5:33:48 PM
Updated: May 4, 2026, 7:39:05 PM
EUVD base score (CVSS 4.0): 6.8 / 10
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0800
Vendors: horsicq
Products: DIE-engine (0 <3.21.0)

ENISA description: Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences or absolute paths. Attackers can exploit insufficient path normalization during archive extraction to write files outside the intended extraction directory and achieve persistent code execution by overwriting user startup scripts.

EUVD references (7)

Affected products (1)

Vendor	Product	Versions	Platforms
horsicq	DIE-engine	`0` (affected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

MITRE references (7) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (3)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://www.cve.org/CVERecord?id=CVE-2026-43616 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org
https://nvd.nist.gov/vuln/detail/CVE-2026-43616 tenable:nvd.nist.gov

Remediations (19)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review

web:blog.qualys.com

With Qualys Policy Audit's out-of-the-box mitigation or Compensatory Controls, which reduce the risk of a vulnerability being exploited because the remediation ( fix / patch ) cannot be done immediately, these security controls are not recommended by any industry standards, such as CIS and DISA-STIG.

2026-05-23 21:15 UTC
CISA Warns of Fortinet 0-Day Vulnerability Actively Exploited in Attacks

web:cybersecuritynews.com

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE - 2026 -35616, a critical improper access control vulnerability in Fortinet FortiClient Enterprise Management Server (EMS), to its Known Exploited Vulnerabilities (KEV) catalog on April 6, 2026 , mandating federal agencies to remediate by April 9, 2026 .

2026-05-23 21:15 UTC
Patch Tuesday, April 2026 Edition - Krebs on Security

web:krebsonsecurity.com

For a clickable, per- patch breakdown, check out the SANS Internet Storm Center Patch Tuesday roundup. Running into problems applying any of these updates?

2026-05-23 21:15 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 21:15 UTC
CVE-2026-35616: Fortinet FortiClientEMS improper access control ...

web:securityboulevard.com

Exploitation has been observed for CVE - 2026 -35616, a critical improper access control zero-day vulnerability affecting Fortinet FortiClientEMS devices.Key takeaways:CVE- 2026 -35616, an improper access control vulnerability, has been exploited in the wild as a zero-day. Public exploit code has been identified and Fortinet products have a long history of targeting by malicious actors. Hotfixes ...

2026-05-23 21:15 UTC
Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS

web:thehackernews.com

Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vulnerability, tracked as CVE - 2026 -35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading to privilege escalation. "An improper access control vulnerability [CWE-284] in FortiClient EMS may allow an ...

2026-05-23 21:15 UTC
CISA orders feds to patch exploited Fortinet EMS flaw by Friday

web:www.bleepingcomputer.com

On Monday, CISA added CVE - 2026 -35616 to its Known Exploited Vulnerabilities (KEV) Catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to patch FortiClient EMS instances by ...

2026-05-23 21:15 UTC
Critical Patches Issued for Microsoft Products, April 14, 2026

web:www.cisecurity.org

<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

2026-05-23 21:15 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-05-23 21:15 UTC
Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic

web:www.techrepublic.com

Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

2026-05-23 21:15 UTC
THREAT ADVISORY RedSun Zero-Day (Windows Defender) April 17, 2026

web:blackswan-cybersecurity.com

Cloud Files API activity originating outside legitimate OneDrive/sync processes. Mitigation Steps: Apply all Windows updates immediately (monitor MSRC for an emergency RedSun-specific patch . None released as of April 17, 2026 ). Supplement Defender with a secondary EDR solution (e.g., Huntress) capable of detecting Defender bypasses.

2026-06-03 07:48 UTC
CVE-2026-35616: Fortinet FortiClient EMS Bug - What It Means for Your ...

web:integsec.com

Meta Description: CVE - 2026 -35616 is a critical vulnerability in FortiClient EMS allowing unauthenticated remote code execution. Learn business risks and urgent response steps for USA and Canada organizations.

2026-06-03 07:48 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-06-03 07:48 UTC
Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy ...

web:thehackernews.com

FortiClient EMS flaw CVE - 2026 -35616 enabled malware delivery via fake updates, risking credential theft across endpoints.

2026-06-03 07:48 UTC
New FortiClient EMS flaw exploited in attacks, emergency patch released

web:www.bleepingcomputer.com

Fortinet has released an emergency weekend security update for a new critical FortiClient Enterprise Management Server (EMS) vulnerability that is actively exploited in attacks.

2026-06-03 07:48 UTC
New infostealer reaches enterprise devices through FortiClient EMS ...

web:www.helpnetsecurity.com

Attackers are delivering an infostealer to enterprise computers by exploiting a known vulnerability ( CVE - 2026 -35616) in FortiClient EMS.

2026-06-03 07:48 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-06-03 07:48 UTC
CVE-2026-35616 Fortinet FortiClientEMS zero-day exploited

web:www.tenable.com

Exploitation has been observed for CVE - 2026 -35616, a critical improper access control zero-day vulnerability affecting Fortinet FortiClientEMS devices. Key takeaways: CVE - 2026 -35616, an improper access control vulnerability, has been exploited in the wild as a zero-day. Public exploit code has been identified and Fortinet products have a long history of targeting by malicious actors. Hotfixes ...

2026-06-03 07:48 UTC
Attackers exploited the FortiClient EMS bug as a 0-day

web:www.theregister.com

Fortinet released an emergency patch over the weekend for a critical FortiClient Enterprise Management Server (EMS) bug believed to be under attack since at least March 31. The flaw, tracked as CVE - 2026 -35616, is an improper access control vulnerability that allows unauthenticated attackers to execute unauthorized code or commands via crafted requests. It earned a critical 9.1 CVSS rating, and ...

2026-06-03 07:48 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-43616.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43616",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-04T19:38:52.093440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-04T19:39:05.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "DIE-engine",
          "vendor": "horsicq",
          "versions": [
            {
              "lessThan": "3.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mobasi Security Team"
        }
      ],
      "datePublic": "2026-04-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences or absolute paths. Attackers can exploit insufficient path normalization during archive extraction to write files outside the intended extraction directory and achieve persistent code execution by overwriting user startup scripts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-04T17:33:48.591Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/horsicq/DIE-engine/releases/tag/3.21"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/horsicq/Detect-It-Easy"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/horsicq/Formats/commit/56cdf50ee3c72c56284e2819b23e98332842d259"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/horsicq/XArchive/commit/6a2aa84c2fd120b704f76bb5c5ee3e9b5a7a0fcc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/horsicq/DIE-engine/commit/cbbe1688e58ffd430d284bf65f336973f083db69"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/horsicq/DIE-engine/commit/7fd300b926daf19707b2a36f0abe8b60a51308ee"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/detect-it-easy-path-traversal-arbitrary-file-write"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Detect-It-Easy < 3.21 Path Traversal Arbitrary File Write",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-43616",
    "datePublished": "2026-05-04T17:33:48.591Z",
    "dateReserved": "2026-05-01T18:22:45.639Z",
    "dateUpdated": "2026-05-04T19:39:05.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}