CVE-2026-35616criticalunder attackCWE-284

CVE-2026-35616: critical vulnerability in Fortinet FortiClientEMS

Published · Updated

93Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 9.1%
from disclosure to weapon15 days
Published on NVDApr 4
1st PoC+15d
CISA KEV+2d
exploitation probability
9.1%top 5% of all CVEs
observed exploitation
yesCISA + VulnCheck
4 public exploit(s)
Action required by CISAfederal deadline: 2026-04-09

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

FortiClientEMS versions 7.4.5 to 7.4.6 have a flaw that allows attackers without login credentials to run unauthorized code or commands on the system. This is critical because it gives attackers full control over the management system used to protect company devices.

Technical detail

An improper access control vulnerability in FortiClientEMS 7.4.5-7.4.6 permits unauthenticated remote attackers to execute arbitrary code or OS commands via specially crafted requests. The vulnerability stems from insufficient authentication checks on sensitive endpoints, allowing bypass of security controls and direct code execution with system privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Affected products
Fortinet · FortiClientEMS
public PoCs found — 4
githubgithub.com/HORKimhab/CVE-2026-35616★ 0githubgithub.com/jenniferreire26/CVE-2026-35616★ 0vulncheckvulncheck.com/xdb/d1447b3dc7f2unverifiedvulncheckvulncheck.com/xdb/7ae94a2ff59bunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Fortinet FortiClientEMS

In the same product, most dangerous first.

CVE-2023-48788CRITICALCVE-2023-48788EPSS 98.4%KEVCVE-2026-21643CRITICALCVE-2026-21643EPSS 93.9%KEVCVE-2025-59922MEDIUMCVE-2025-59922EPSS 7.8%CVE-2024-33508MEDIUMCVE-2024-33508EPSS 1.3%CVE-2023-47534HIGHCVE-2023-47534EPSS 1.1%CVE-2024-23106HIGHCVE-2024-23106EPSS 1.0%
References
https://fortiguard.fortinet.com/psirt/FG-IR-26-099https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616