CVE-2026-35616

This vulnerability is like leaving a door unlocked so someone outside can walk in and operate the system without permission. With specially crafted requests, an attacker may be able to trigger actions that should only be available to authorized users—potentially including running unauthorized code or commands.

This matters to you if you use or manage Fortinet FortiClientEMS version 7.4.5, 7.4.6 (including Fortinet FortiClientEMS installations used for device management). It does not affect every Fortinet product—this specific issue is tied to FortiClientEMS in that version range.

This is RED because it is being exploited “in the wild,” and known exploited by CISA (KEV) indicates real-world attacker activity. The combination of a critical impact and very high likelihood of exploitation means you should treat this as an urgent patch/deployment issue rather than something to schedule for later.

1. Confirm exposure: Identify your FortiClientEMS version(s) and verify you are running 7.4.5 or 7.4.6. Confirm whether the server is reachable from the public internet (directly or via a web/admin interface). 2) Patch immediately: Upgrade Fortinet FortiClientEMS to a version outside 7.4.5–7.4.6 that includes the fix. If you manage this through a vendor process, request an expedited patch/upgrade plan for your environment. 3) Compensating controls while patching: If there is any delay, limit who can talk to FortiClientEMS by tightening firewall rules and removing direct public exposure. Only allow access from trusted internal networks or specific management hosts that need it. 4) Validate: After upgrading, re-check the installed version and that the service still runs normally. Ensure the same network restrictions are in place. 5) Monitor: Since exploitation is already known to be happening in the wild, ask your IT team to review logs around the FortiClientEMS timeframe for suspicious requests and unexpected command/execution attempts. Also monitor for signs of compromise in related systems (for example, unusual processes or changes triggered by the EMS).

Severity is critical (CVSS 9.8) and the issue is listed as known exploited in the wild (CISA KEV). EPSS is 88.5%, indicating a very high estimated likelihood of exploitation in the next 30 days. Affected software is Fortinet FortiClientEMS (Fortinet FortiClientEMS 7.4.5 through 7.4.6). The weakness is improper access control: an unauthenticated attacker can send crafted requests that bypass expected authorization checks and may result in unauthorized code/command execution. The reported exploitation status is “itw” (exploitation in the wild). Public exploit availability is not known to be available (public exploit available: no), and there is no known Nuclei detection template. Attackers have been observed in this space under named actor reporting (Volt Typhoon), and press attention is rising.