Fortinet Patches Exploited FortiClient EMS Vulnerability

Fortinet disclosed a critical vulnerability in its FortiClient Enterprise Management Server (EMS) software on April 6, 2026, confirming active exploitation by threat actors in zero-day attacks. The flaw, tracked as CVE-2026-35616 and rated at a CVSS score of 9.1, affects versions 7.4.5 and 7.4.6 of the platform, which manages endpoint security configurations across enterprise networks.

The vulnerability stems from improper access controls, enabling unauthenticated attackers to bypass API authentication and authorization. This allows them to send crafted requests that execute unauthorized code or commands on affected systems. Fortinet described the issue in its security advisory as one where "an improper access control vulnerability in FortiClient EMS may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests." Cybersecurity firm Defused Cyber, which identified the flaw along with researcher Nguyen Duc Anh, reported observing zero-day exploitation earlier in the week. Honeypot sensors from watchTowr first detected exploitation attempts on March 31, 2026, suggesting initial probing by attackers.

In response, Fortinet released emergency...