Fortinet EMS CVE-2026-35616 exploited to spread malware

A critical vulnerability in Fortinet's enterprise management software is being actively exploited to deploy previously undocumented information-stealing malware across corporate networks. Cybersecurity researchers observed attacks in May 2026 where threat actors used the flaw to disguise malicious payloads as legitimate software updates, compromising managed endpoints.

The vulnerability, tracked as CVE-2026-35616, is an improper access control flaw in FortiClient Enterprise Management Server (EMS), a centralized platform for deploying and monitoring endpoint security software. It allows unauthenticated attackers to send specially crafted HTTP requests that are processed as legitimate administrative actions. This bypasses API authentication and authorization, enabling remote code execution. Fortinet confirmed the flaw was being exploited in the wild and released emergency hotfixes in early April 2026, urging users of versions 7.4.5 and 7.4.6 to apply them immediately. A permanent fix is included in version 7.4.7. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog.