Critical Flaw in FortiClient EMS Under Exploitation, Emergency Patch Released
Active exploitation or massive impact — immediate action required
Fortinet found a serious problem in its software that hackers are already using to break in. They quickly made a fix, and everyone using that software needs to update it right away to stay safe.
Fortinet has confirmed a critical vulnerability in FortiClient EMS is being actively exploited. An emergency patch has been released to address this zero-day flaw, tracked as CVE-2026-35616.
The Flaw
Fortinet has identified a critical vulnerability in its FortiClient EMS (Endpoint Management Server), tracked as CVE-2026-35616. This flaw, which has been labeled a zero-day, allows unauthorized access through improper access controls, enabling unauthenticated attackers to execute unauthorized code or commands via crafted requests. It has been reported that this vulnerability has been under active exploitation since at least March 31.
What's at Risk
The vulnerability poses severe risks for organizations using FortiClient EMS, which is widely utilized for managing and securing both remote and office computers. Given Fortinet's extensive user base across various sectors, the potential impact could be significant. Notably, this is the second critical flaw in FortiClient to be exploited in recent weeks, following another vulnerability that also allowed for unauthenticated remote code execution.
Patch Status
In response to the discovery, Fortinet has released an emergency hotfix for FortiClient EMS versions 7.4.5 and 7.4.6. Users are strongly advised to apply this patch immediately to mitigate the risk of exploitation. The US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and has set a deadline for federal agencies to apply the patch.
Immediate Actions
Organizations using FortiClient EMS should:
- Apply the emergency hotfix as soon as possible.
- Monitor systems for any unusual activity that may indicate exploitation.
- Review security policies to ensure they are robust against unauthorized access.
Security experts have noted that the initial exploitation behavior was characterized as "low and slow," but this quickly escalated as attackers began to leverage the zero-day more opportunistically. As always, the best time to apply the hotfix was yesterday, and the second best time is right now. This situation underscores the importance of maintaining up-to-date security measures and being vigilant against potential threats.
🔍 How to Check If You're Affected
- 1.Monitor for unusual system behavior.
- 2.Check logs for unauthorized access attempts.
- 3.Ensure the latest patch is applied to FortiClient EMS.
The rapid escalation of exploitation tactics following the discovery of this zero-day highlights the urgent need for organizations to prioritize patch management and proactive security measures.
🗓️ Story Timeline
Sources
Also covered by
Attackers exploited this critical FortiClient EMS bug as a 0-day