Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS

Ravie LakshmananApr 05, 2026Vulnerability / API Safety

Fortinet has launched out-of-band patches for a vital safety flaw impacting FortiClient EMS that it mentioned has been exploited within the wild.

The vulnerability, tracked as CVE-2026-35616 (CVSS rating: 9.1), has been described as a pre-authentication API entry bypass resulting in privilege escalation.

“An improper entry management vulnerability [CWE-284] in FortiClient EMS might permit an unauthenticated attacker to execute unauthorized code or instructions through crafted requests,” Fortinet mentioned in a Saturday advisory.

The difficulty impacts FortiClient EMS variations 7.4.5 by means of 7.4.6. It is anticipated to be absolutely patched within the upcoming model 7.4.7, though the corporate has launched a hotfix to handle it. 

Simo Kohonen from Defused Cyber and Nguyen Duc Anh have been credited with discovering and reporting the flaw. In a submit on X, Defused Cyber mentioned it noticed zero-day exploitation of CVE-2026-35616 earlier this week. In keeping with watchTowr, exploitation makes an attempt towards CVE-2026-35616 have been first recorded towards its honeypots on March 31, 2026.

Profitable exploitation of the flaw may permit an unauthenticated attacker to sidestep API authentication and authorization protections, and execute malicious code or instructions through crafted requests. 

“Fortinet has noticed this to be exploited within the wild and urges susceptible prospects to put in the hotfix for FortiClient EMS 7.4.5 and seven.4.6,” the corporate added.

The improvement comes merely days after one other recently-patched, vital vulnerability in FortiClient EMS (CVE-2026-21643, CVSS rating: 9.1) got here underneath lively exploitation. It is at the moment not recognized if the identical menace actor is behind the exploitation of each the failings, and if they’re being weaponized collectively.

Given the severity of the vulnerabilities, customers are suggested to replace their FortiClient EMS to the most recent model as quickly as attainable.

“The timing of the ramp-up of in-the-wild exploitation of this zero-day is probably going not coincidental,” watchTowr CEO and founder Benjamin Harris informed The Hacker Information.

“Attackers have proven repeatedly that vacation weekends are one of the best time to maneuver. Safety groups are at half energy, on-call engineers are distracted, and the window between compromise and detection stretches from hours to days. Easter, like every other vacation, represents alternative.”

“What’s disappointing is the larger image. This is the second unauthenticated vulnerability in FortiClient EMS in a matter of weeks.”

“So, as soon as once more, organizations operating FortiClient EMS and uncovered to the Web ought to deal with this as an emergency response scenario, not one thing to select up on Tuesday morning. Apply the hotfix. Attackers have already got a head begin.”