Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-35616

Fortinet FortiClient EMS Improper Access Control Vulnerability

9.8
CVSS 3.1
1
story
APR 6
added to KEV
Severity
9.8 Critical · vendor score
Vendor
Fortinet
Product
FortiClient EMS
Published
Apr 4, 2026
Added to KEV
Apr 6, 2026
KEV deadline
Apr 9, 2026
Ransomware use
Unknown
Weakness
CWE-284

What it is

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesFortinet CVE-2026-35616 Actively ExploitedThe company published an advisory on Saturday and urged all customers who are running affected versions of the software to install the hotfix as quickly as possible. The bug affects versions 7.4.5 and 7.4.6 of FortiClient EMS.DENNIS FISHER · 1 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixfortiguard.fortinet.com/psirt/FG-IR-26-099