Fortinet FortiClient EMS: CVE-2026-35616 Exploited as a Zero-Day in the Build Shipped to Fix the Last One

Fortinet published advisory FG-IR-26-099 on Saturday, April 4, 2026, disclosing CVE-2026-35616, an improper access control vulnerability in FortiClient EMS that allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Only two builds are affected: FortiClientEMS 7.4.5 and 7.4.6. Version 7.4.5 is also the build Fortinet shipped on February 6, 2026 to fix CVE-2026-21643, a separate critical FortiClient EMS SQL injection flaw. " Organizations that applied the February patch promptly moved onto the only release train the April vulnerability affects.

" Attack surface management firm watchTowr had already recorded exploitation attempts against its sensor network on March 31, 2026, four days before the advisory existed. CISA added the CVE to its Known Exploited Vulnerabilities catalog on Monday, April 6 and set a remediation deadline of Thursday, April 9 for Federal Civilian Executive Branch agencies. Fortinet has not stated that the two vulnerabilities are related.

Executive Summary

KEY FACTS

WhatCVE-2026-35616, titled by Fortinet "API authentication and authorization bypass" and classified as improper access control (CWE-284), permitting unauthenticated code or command execution via crafted API requests. CVSS 9.1 temporal, 9.8 base.
WhoOrganizations running FortiClientEMS 7.4.5 or 7.4.6 on premises. Fortinet states it remediated the issue in FortiClient Cloud and FortiSASE, so customers of those services need take no action. No victim organizations have been named.
HowCrafted requests to the EMS API. Advisory metadata records Attack Type as Unauthenticated and Impact as escalation of privilege. CWE-284 is the parent weakness covering both authentication and authorization failures, and both were bypassable here.
DataNo confirmed data exposure has been disclosed. EMS holds endpoint inventory, security policy and agent control across the managed estate.
ActorNone. No formal technical attribution has been issued by Fortinet, CISA, watchTowr or any other party.
ImpactNo compromise has been publicly attributed to this CVE by any named organization. CISA listed it as known exploited on April 6, 2026 with a federal remediation deadline of April 9, and instructed agencies to check for signs of compromise. Ransomware campaign use is recorded in the KEV catalog as "Unknown".

Incident Overview

WHAT HAPPENED

FortiClient EMS (Endpoint Management Server) is the on-premises console that administers Fortinet's endpoint agents. It provisions the FortiClient VPN and endpoint protection software, pushes security profiles, holds the inventory of managed devices and brokers the relationship between endpoints and the wider Fortinet Security Fabric. It is not a workload. It is the control plane for endpoint defence, which is what makes unauthenticated code execution on it consequential well beyond a single server.

On March 31, 2026, watchTowr's Attacker Eye sensors captured exploitation attempts against FortiClient EMS instances in its sensor network. In watchTowr's description, the sensors provided "early visibility into attacker behavior ahead of the official advisory." At that point no CVE existed publicly, no patch existed and no advisory existed. The flaw was a zero-day in the strict sense. The telemetry establishes that attackers were working the vulnerability before disclosure; it does not establish how many production estates were reached.

Fortinet published FG-IR-26-099 on April 4, 2026, a Saturday. The remediation offered was a hotfix for 7.4.5 and 7.4.6, delivered through the EMS release notes. The advisory described the release fix as pending: "Upcoming FortiClientEMS 7.4.7 will also include a fix for this issue. " Fortinet credited Simo Kohonen of Defused and Nguyen Duc Anh with reporting the vulnerability, and its metadata records the discovery as external.

CISA added CVE-2026-35616 to the KEV catalog on April 6, 2026 with a due date of April 9, placing it in the shortest remediation tier CISA issues. That tier is not reserved for exceptional cases: of the 173 entries CISA added to the catalog in 2026, 66 carry a 3-day deadline, 60 carry 14 days and 44 carry 21 days, and across the catalog's full history the 21-day deadline still dominates, applied to 1,025 of 1,657 entries. The entry's requiredAction field is stock text, identical to that attached to 321 other entries. The product-specific language sits in a different field.

The entry's notes field reads: "Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. " Analysis of the catalog retrieved on August 3, 2026 finds that compromise-check sentence in the notes field of 10 entries out of 1,657, the others covering Ivanti EPMM, F5 BIG-IP, BeyondTrust, WatchGuard, SonicWall, Cisco, Meta and Fortinet's own CVE-2026-24858. Two things follow. CISA expected some agencies to be compromised already rather than merely exposed.

And the instruction to apply "any final mitigations provided by the vendor as soon as they become available" acknowledges that the vendor response was incomplete at listing, which is consistent with a hotfix in hand and 7.4.7 still upcoming.

On April 13, 2026, seven days after the 35616 listing and more than two months after Fortinet published the advisory, CISA added CVE-2026-21643 to the KEV catalog with its own 3-day deadline of April 16. That February advisory carries a contradiction of its own: the summary states that the vulnerability "has been observed to be exploited in the wild," while the advisory's Known Exploited metadata field reads No. CISA's listing resolves the question in favour of the summary text.

FortiClient EMS accounts for two of the six Fortinet CVEs added to KEV in 2026, both rated CVSS 9.1 by the vendor, both unauthenticated pre-authentication execution paths.

Impact Assessment

WHAT WAS EXPOSED

No affected organization has disclosed a compromise, and no data set has been reported stolen. What follows is what control of a FortiClient EMS server grants an attacker, not a claim about what any attacker took.

Endpoint inventory: hostnames, operating system versions, agent versions, group membership and network location for every managed device in the estate.
Security policy control: the ability to modify or weaken endpoint protection profiles, web filtering, application control and firewall rules across managed agents.
Software distribution: EMS is the deployment channel for FortiClient installers and configuration. A distribution channel under attacker control is a trusted path onto every endpoint it serves.
VPN and connectivity configuration: EMS provisions FortiClient VPN settings, which touch remote access into the corporate network.
Administrative credentials and tokens held by or reachable from the EMS host, including its Security Fabric relationships with other Fortinet devices.
Telemetry suppression: an attacker who controls the console that receives endpoint alerts controls what defenders see.

Root Cause Analysis

TECHNICAL FAILURE CHAIN

Authentication and authorization were both bypassable on the API surface.

Fortinet titles the advisory "API authentication and authorization bypass" and classifies the defect as CWE-284, improper access control, the parent weakness covering both. watchTowr describes crafted requests that "bypass authentication and authorization protections entirely, achieving code execution." Privileged API functionality was reachable without a credential, and without an authorization check standing behind the missing credential.

Pre-authentication reachability of code execution paths.

The CVSS vector AV:N/AC:L/PR:N/UI:N records network reachability, low complexity, no privileges and no user interaction. There is no precondition an attacker must satisfy beyond being able to reach the service.

Management plane exposed to untrusted networks.

Exploitation requires network access to the EMS interface. Every instance reachable from the public internet converted a code defect into an entry point. EMS is an internal administration console with no functional requirement to accept connections from arbitrary hosts.

A patch cadence that delivered users into the next vulnerability.

Version 7.4.5 remediated CVE-2026-21643 and carries exposure to CVE-2026-35616. Diligent patching produced a vulnerable estate. This is not a customer failure; it is a vendor release-quality outcome, and it removes the usual assumption that currency equals safety.

Detection dependent on a vendor who published no indicators.

Fortinet released no IOCs. As watchTowr stated, "Detection currently relies on log review and configuration auditing rather than definitive IOC matching." Organizations were asked to determine whether they had been compromised without being told what compromise looks like.

Remediation shipped as a hotfix against a running campaign, on a Saturday.

Exploitation was observed March 31; the advisory landed April 4 with a hotfix rather than a released build, and the version that carries the fix was still upcoming. The gap between observed exploitation and disclosure ran at least four days, and the fix arrived at the point in the week when staffing is lowest.

Detection

INDICATORS OF COMPROMISE

No threat actor IOCs have been published. Fortinet released none, and watchTowr states explicitly that none are available. The NVD record for CVE-2026-35616 lists only two references, the vendor advisory and the CISA KEV entry. The technical identifiers below are the full set of published detail.

VULNERABILITY IDENTIFIERS

CVECVE-2026-35616
Fortinet PSIRT advisoryFG-IR-26-099, "API authentication and authorization bypass", published April 4, 2026
Advisory metadataAttack Type Unauthenticated, Discovered External, Known Exploited Yes, Impact escalation of privilege
CWECWE-284, Improper Access Control
CVSS v3.1 temporal (Fortinet): 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v3.1 base (NVD, assigned by Fortinet as CNA): 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reading the temporal metrics: E:F means a functional exploit exists, RL:O means an official fix is available, RC:C means the report is confirmed. Fortinet encoded confirmed working exploitation into the score itself. The 9.1 is lower than the 9.8 base only because a fix shipped, not because the vulnerability is less severe.

AFFECTED BUILDS AND REMEDIATION STATUS

AffectedFortiClientEMS 7.4.5 through 7.4.6
Remediation available at disclosurehotfix for 7.4.5 and 7.4.6, distributed through the EMS release notes
Release fix at disclosurenot yet shipped. Fortinet stated "Upcoming FortiClientEMS 7.4.7 will also include a fix for this issue. In the meantime the hotfix above is sufficient to prevent it entirely."
Not affectedFortiClientEMS 8.0, FortiClientEMS 7.2
Remediated by Fortinet with no customer action requiredFortiClient Cloud, FortiSASE
CPEcpe:2.3:a:fortinet:forticlientems:7.4.5 and cpe:2.3:a:fortinet:forticlientems:7.4.6

REGULATORY EXPOSURE

The vulnerability itself is not a reportable event. Exploitation of it, or failure to remediate it within a defensible window once a fix existed, is where liability attaches.

CISA Binding Operational Directive 22-01 - remediation of CVE-2026-35616 was mandatory for Federal Civilian Executive Branch agencies by April 9, 2026. The catalog's required action is its standard instruction to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use of the product; its notes field additionally directs agencies to check internet-accessible Fortinet products for signs of compromise.
GDPR Article 32(1)(b)the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services - and Article 32(1)(d), a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures. An organization compromised through an unremediated EMS instance after April 4, 2026, with a hotfix available and a KEV listing published, has a weak defence on state of the art and cost of implementation.
GDPR Article 5(1)(f)integrity and confidentiality, engaged where endpoint estate compromise touches personal data.
GDPR Articles 33 and 34 - 72-hour notification to the supervisory authority and notification to data subjects where risk is high. Compromise of an endpoint management plane makes scoping difficult, and scoping difficulty does not extend the 72-hour clock.
NIS2 Directive - essential and important entities face a 24-hour early warning and 72-hour incident notification. Managed security service providers and their customers both sit in scope, and EMS compromise at a provider is a multi-client event.
UK GDPR and Data Protection Act 2018 - ICO enforcement up to GBP 17.5 million or 4 percent of global turnover. The ICO has consistently treated failure to apply available fixes for known exploited vulnerabilities as an Article 32 failure.
SEC Item 1.05 Form 8-K - US registrants must disclose material cybersecurity incidents within four business days of determining materiality. A compromised endpoint management plane raises a materiality question that cannot be deferred indefinitely on the basis that scoping is incomplete.
Saudi Arabia NCA Essential Cybersecurity Controls - vulnerability and patch management obligations are mandatory for government bodies and critical national infrastructure. PDPL Article 36(1) provides for fines up to SAR 5 million where personal data is affected, with SDAIA as the designated Competent Authority.
UAE PDPL, Federal Decree-Law No. 45 of 2021, overseen by the UAE Data Office established under Federal Decree-Law No. 44 of 2021, with separate DIFC and ADGM data protection regimes for entities in those free zones.
Switzerland revFADP - liability can attach to named individuals, with penalties up to CHF 250,000 for natural persons, which places personal exposure on the executives who own patch decisions.
HIPAA Security Rule - 45 CFR 164.308(a)(1)(ii)(A) risk analysis is a Required implementation specification. 45 CFR 164.308(a)(5)(ii)(B) protection from malicious software is Addressable, meaning a covered entity must implement it, or document why it is not reasonable and appropriate and adopt an equivalent alternative. Both are engaged by a known-exploited management plane flaw.

Analytical Limitations

INTELLIGENCE GAPS

No victim organizations have been identified.

Exploitation is confirmed by both the vendor and watchTowr, but not a single compromised entity has been named or has self-disclosed. The true scale is unknown.

No attribution exists.

No formal technical attribution has been issued by Fortinet, CISA, watchTowr or any other party. Motive, whether espionage, ransomware staging or access brokering, is unestablished. CISA records ransomware campaign use as "Unknown".

No indicators of compromise are public.

Defenders cannot hunt for this with signatures. Whether Fortinet possesses IOCs it has chosen not to release is unknown.

The vulnerable endpoint is undisclosed.

Neither Fortinet nor watchTowr identified which API endpoint or request structure is abused, so independent detection engineering is not possible from public information.

The relationship between CVE-2026-21643 and CVE-2026-35616 is unresolved.

The two share a CVSS score, a product, a pre-authentication execution outcome and a boundary at version 7.4.5. Whether 7.4.5 introduced the second flaw while fixing the first has not been stated by Fortinet, and both The Hacker News and watchTowr describe the link as unconfirmed.

Exposure counts are unavailable.

No internet-scan figure for reachable FortiClient EMS instances from Shadowserver, Censys or Shodan was retrieved for this article, so the size of the attack surface at disclosure is unquantified.

Dwell time is unknown.

March 31, 2026 is the earliest publicly reported exploitation against watchTowr sensors, not necessarily the earliest exploitation anywhere. Nothing establishes how long the vulnerability was in use before the sensors caught it, or how many production estates were reached.

The exploitation status of CVE-2026-21643 is recorded inconsistently by the vendor.

The February advisory states the flaw was observed exploited in the wild while its Known Exploited metadata field reads No. Fortinet has not explained the discrepancy.

The 7.4.7 release date is not established by any source retrieved for this article.

Organizations relying on the hotfix have no published date at which the release fix becomes available.

Assessment

ZERO|TOLERANCE Advisory

Establish which EMS builds you actually run, not which ones you believe you run.

Query every FortiClient EMS server for its exact build string and flag anything reporting 7.4.5 or 7.4.6. The estate to search is wider than the production console: lab and staging instances, an EMS left running after a migration, instances operated on your behalf by a managed service provider, and any server rebuilt from a 7.4.5 image. Because 7.4.5 was the remediation target for the February flaw, a well-run patch programme is more likely to be affected than a neglected one, so do not use "we patch promptly" as a reason to deprioritise the search.

Apply the hotfix now, and do not wait for 7.4.7.

At disclosure the release fix did not exist. Fortinet's Solution section directs customers to install the hotfix for 7.4.5 and 7.4.6 and states that "Upcoming FortiClientEMS 7.4.7 will also include a fix for this issue. In the meantime the hotfix above is sufficient to prevent it entirely." watchTowr is more direct: "Apply the hotfix immediately," and "Do not defer this action pending the 7.4.7 release." The hotfix is the remediation for an actively exploited vulnerability carrying a 3-day federal deadline. Track 7.4.7 separately and schedule the upgrade when it ships, so the fix survives rebuilds and you remain on a supported branch, but treat that upgrade as a follow-on task rather than the remediation.

Remove the EMS management interface from internet reachability, and treat that as the durable control.

The vulnerability requires network access to the service, so exposure is the difference between a code defect and an incident. Bind the administration interface to internal interfaces, place it behind VPN or a ZTNA broker, and restrict source addresses to named administrative ranges. Verify from outside your perimeter rather than trusting the firewall policy: attempt to reach the console from an external host and confirm the connection fails. Endpoint agents themselves may need to reach EMS, so separate the agent communication path from the administrative interface rather than exposing both.

Hunt without signatures, because none exist.

Fortinet published no IOCs, so detection is log review and configuration audit. Pull EMS application and web server logs from at least March 24, 2026, a week before the earliest publicly observed exploitation, and look for requests to administrative or API paths that returned success without a preceding authentication event, request bursts from single sources that do not match your administrator ranges, and API activity outside change windows. On the EMS host itself, review process creation for shells or scripting interpreters spawned by the EMS service account, scheduled task and service creation, and outbound connections from the EMS server to destinations it has no reason to contact.

Audit configuration against a known-good baseline, since the impact of this flaw is policy change rather than data theft.

Compare current state against a pre-March 2026 backup and specifically check for administrator accounts added or re-enabled, endpoint protection profiles weakened or scoped away from device groups, changes to FortiClient deployment packages and installer sources, altered VPN configuration pushed to endpoints, and modified Security Fabric trust relationships with other Fortinet devices. A weakened policy pushed to every managed endpoint is the outcome that persists after the server is fixed.

Reclassify EMS as tier-0 infrastructure and apply tier-0 controls.

A server that distributes software and security policy to every endpoint deserves the same treatment as a domain controller: administration only from dedicated privileged access workstations, phishing-resistant MFA using FIDO2 hardware keys for every administrator, no shared or service-embedded administrative credentials, network segmentation that prevents the EMS host from initiating arbitrary outbound connections, and log forwarding to a SIEM the EMS administrators cannot alter.

If the audit indicates compromise, rebuild rather than clean.

Code execution as the EMS service means the integrity of the host and its stored configuration is in question. Restore from known-good media, rotate all credentials and API tokens held on or reachable from the host, re-establish Security Fabric trust relationships with new secrets, and re-push endpoint policy from a validated baseline rather than from the configuration present on the compromised server.

Change the assumption that patching ends the review.

The lesson of 7.4.5 is that the version you upgrade to can carry the next vulnerability. Subscribe to the Fortinet PSIRT advisory feed, and reconcile the CISA KEV catalog against your asset inventory on a fixed weekly cadence rather than reacting to press coverage. Do not rely on a vendor's Known Exploited metadata field as your trigger; the February advisory for this same product reads No in that field while its own summary reports exploitation in the wild. The interval that mattered here was the four days between exploitation and disclosure, which no patch programme can close. What it can close is the interval between disclosure and your knowing whether you are affected.

References

SOURCES

Fortinet PSIRT, FG-IR-26-099, "API authentication and authorization bypass", published April 4, 2026 - https://fortiguard.fortinet.com/psirt/FG-IR-26-099 Fortinet PSIRT, FG-IR-25-1142, FortiClient EMS SQL injection (CVE-2026-21643), published February 6, 2026 - https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 CISA, Known Exploited Vulnerabilities Catalog, catalog version 2026.08.03, retrieved August 3, 2026 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog CISA, KEV JSON feed (entries for CVE-2026-35616, CVE-2026-21643, CVE-2023-48788; deadline and notes-field analysis) - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json NIST National Vulnerability Database, CVE-2026-35616, and NVD REST API record - https://nvd.nist.gov/vuln/detail/CVE-2026-35616 watchTowr, "Fortinet FortiClient EMS Zero-Day CVE-2026-35616: Active Exploitation Underway" - https://watchtowr.com/resources/fortinet-forticlient-ems-zero-day-cve-2026-35616-active-exploitation-underway/ The Hacker News, "Fortinet Patches Actively Exploited CVE-2026-35616", April 5, 2026 - https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html

MORE SUPPLY CHAIN →

Fortinet FortiClient EMS CVE-2026-35616 Exploited as a Zero-Day in the Build Shipped to Fix the Last One