Critical Vulnerability in FortiClient EMS Leads to Cyber Attacks: Emergency Patch Issued

Fortinet Releases Emergency Security Update for Critical Vulnerability

Over the weekend, Fortinet took swift action by releasing an emergency security update to address a critical vulnerability in the FortiClient Enterprise Management Server (EMS). This vulnerability, identified as CVE-2026-35616, is currently being actively exploited in malicious attacks.

The vulnerability, categorized as an improper access control issue, enables unauthorized attackers to execute malicious code or commands through carefully crafted requests.

Fortinet moved quickly to patch the vulnerability on Saturday, confirming that it had already been exploited in real-world scenarios.

Fortinet issued a warning, stating, “Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6.”

According to Fortinet, the vulnerability affects FortiClient EMS versions 7.4.5 and 7.4.6 and can be addressed by applying one of the provided hotfixes.

Furthermore, the upcoming release of FortiClient EMS 7.4.7 will also include a fix for this vulnerability, ensuring enhanced security measures. It’s important to note that FortiClient EMS 7.2 remains unaffected.

The vulnerability was initially discovered by cybersecurity firm Defused, which identified it as a pre-authentication API access bypass. This flaw allows threat actors to circumvent authentication and authorization controls entirely.

Defused reported that the vulnerability was being actively exploited as a zero-day exploit before responsibly disclosing it to Fortinet earlier this week.

Recent findings from internet security watchdog Shadowserver revealed that over 2,000 FortiClient EMS instances are exposed online, with a significant number of them located in the United States and Germany.

This vulnerability comes in the wake of another critical flaw, CVE-2026-21643, in FortiClient EMS, which was reported last week and also exploited in attacks. Both vulnerabilities were discovered by Defused, with additional credit given to Nguyen Duc Anh for identifying the latest flaw.

Fortinet strongly advises its customers to promptly apply the provided hotfixes or upgrade to version 7.4.7 upon its release to mitigate the risk of potential compromises.