Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS
Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS
https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html
Publish Date: 2026-04-05 00:32:00
Source Domain: thehackernews.com
Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild.
The vulnerability, tracked as CVE-2026-35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading to privilege escalation.
“An improper access control vulnerability [CWE-284] in FortiClient EMS may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests,” Fortinet said in a Saturday advisory.
The issue affects FortiClient EMS versions 7.4.5 through 7.4.6. It’s expected to be fully patched in the upcoming version 7.4.7, although the company has released a hotfix to address it.
Simo Kohonen from Defused Cyber and Nguyen Duc Anh have been credited with discovering and reporting the flaw. In a post on X, Defused Cyber said it observed zero-day exploitation of CVE-2026-35616 earlier this week. According to watchTowr, exploitation attempts against CVE-2026-35616 were first recorded against its honeypots on March 31, 2026.
Successful exploitation of the flaw could allow an unauthenticated attacker to sidestep API authentication and authorization protections, and execute malicious code or commands via crafted requests.
“Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,” the company added.
The development comes merely days after another recently-patched, critical vulnerability in FortiClient EMS (CVE-2026-21643, CVSS score: 9.1) came under active exploitation. It’s currently not known if the same threat actor is behind the exploitation of both the flaws, and if they are being weaponized together.
Given the severity of the vulnerabilities, users are advised to update their FortiClient EMS to the latest version as soon as possible.
“The timing of the ramp-up of in-the-wild…
