{"id":231724,"date":"2026-04-05T14:45:00","date_gmt":"2026-04-05T18:45:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/05\/new-forticlient-ems-flaw-exploited-in-attacks-emergency-patch-released\/"},"modified":"2026-04-06T09:25:13","modified_gmt":"2026-04-06T13:25:13","slug":"new-forticlient-ems-flaw-exploited-in-attacks-emergency-patch-released","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/05\/new-forticlient-ems-flaw-exploited-in-attacks-emergency-patch-released\/","title":{"rendered":"New FortiClient EMS flaw exploited in attacks, emergency patch released"},"content":{"rendered":"

New FortiClient EMS flaw exploited in attacks, emergency patch released<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/new-forticlient-ems-flaw-cve-2026-35616-exploited-in-attacks\/amp\/<\/a><\/p>\n

Publish Date: 2026-04-05 14:45:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

Fortinet has released an emergency weekend security update for a new critical FortiClient Enterprise Management Server (EMS) vulnerability that is actively exploited in attacks.<\/p>\n

Tracked as CVE-2026-35616, the flaw is an improper access control vulnerability that allows unauthenticated attackers to execute code or commands via specially crafted requests.<\/p>\n

The issue was patched Saturday, with Fortinet confirming it has been exploited in the wild.<\/p>\n

“Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,” warns Fortinet.<\/p>\n

Fortinet says the vulnerability impacts FortiClient EMS versions 7.4.5 and 7.4.6 and can be mitigated by installing one of the following hotfixes:<\/p>\n

The vulnerability will also be fixed in the upcoming\u00a0FortiClientEMS 7.4.7.\u00a0FortiClient EMS 7.2 is not affected.<\/p>\n

The flaw was discovered by cybersecurity firm Defused, which described it as a pre-authentication API access bypass\u00a0that allows attackers to bypass authentication and authorization controls entirely.<\/p>\n

Defused shared on X that they observed the flaw being exploited as a zero-day earlier this week before reporting it to Fortinet under responsible disclosure.<\/p>\n

Internet security watchdog Shadowserver has found over 2,000 exposed FortiClient EMS instances online, with the majority located in the USA and Germany.<\/p>\n

The vulnerability follows a separate critical FortiClient EMS flaw, CVE-2026-21643, reported last week and also actively exploited in attacks.<\/p>\n

Both vulnerabilities were discovered by Defused, with Fortinet also crediting Nguyen Duc Anh for the latest flaw.<\/p>\n

Fortinet is urging customers to apply the hotfixes immediately or upgrade to version 7.4.7 when it becomes available to mitigate the risk of compromise.<\/p>\n

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.<\/p>\n

This whitepaper…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

New FortiClient EMS flaw exploited in attacks, emergency patch released https:\/\/www.bleepingcomputer.com\/news\/security\/new-forticlient-ems-flaw-cve-2026-35616-exploited-in-attacks\/amp\/ Publish Date: 2026-04-05 14:45:00…<\/p>\n","protected":false},"author":1,"featured_media":231725,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2023\/03\/13\/Fortinet.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,27],"class_list":["post-231724","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231724"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=231724"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231724\/revisions"}],"predecessor-version":[{"id":231726,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231724\/revisions\/231726"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/231725"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=231724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=231724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=231724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}