Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS

Fortinet has released emergency patches for CVE-2026-35616, a critical pre-authentication API access bypass vulnerability in FortiClient EMS actively exploited in the wild.

• •CVE-2026-35616 (CVSS 9.1) is an improper access control flaw (CWE-284) in FortiClient EMS versions 7.4.5 and 7.4.6, allowing unauthenticated remote code execution via crafted API requests.
• •Zero-day exploitation was first recorded by watchTowr honeypots on March 31, 2026, and confirmed by Defused Cyber earlier this week.
• •A hotfix is now available for affected versions; a full fix is expected in the upcoming version 7.4.7.
• •This is the second critical unauthenticated vulnerability in FortiClient EMS within weeks, following CVE-2026-21643 (CVSS 9.1), which is also under active exploitation.
• •