Fortinet

Overview Attribute Value CVE ID CVE-2026-35616 CVSS Score 9.1 (Critical) Vendor Fortinet Product FortiClient EMS Vulnerability Type Improper Access Control CWE CWE-284 (Improper Access Control) KEV Added April 6, 2026 Exploitation Status Actively Exploited Affected Versions Version Status 7.4.5 ❌ Vulnerable 7.4.6 ❌ Vulnerable 7.4.7+ ✅ Patched (upcoming) 7.2.x ✅ Not Affected Description An improper access control vulnerability exists in FortiClient EMS that allows unauthenticated remote code execution. An attacker can send crafted requests to bypass authentication and authorization protections entirely, achieving code execution on the underlying server without valid credentials or user interaction. ...

Another week, another edge device zero-day. This time it’s Fortinet FortiClient EMS, and CISA has already added it to the Known Exploited Vulnerabilities (KEV) catalog. Here’s the breakdown for both offensive and defensive practitioners. The Vulnerability: CVE-2026-35616 CVSS Score: 9.1 (Critical) Affected Versions: FortiClient EMS 7.4.5 FortiClient EMS 7.4.6 Not Affected: FortiClient EMS 7.2 and below. The flaw is an improper access control issue in the FortiClient EMS API. An unauthenticated attacker can send crafted requests that bypass authentication and authorization entirely, achieving remote code execution on the underlying server. ...