Fortinet FortiClient EMS Improper Access Control Vulnerability 

Vulnerability Number: CVE‑2026‑35616 

Severity Level: Critical 

Executive Summary 

Fortinet has disclosed an improper access control flaw in FortiClient EMS versions 7.4.5 through 7.4.6 that allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests. The vulnerability is rated CVSS 3.1 9.8 (Critical) and appears in CISA’s Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 9 April 2026. 

Details 

Technical description: A missing access‑control check in FortiClient EMS permits crafted network requests to bypass authentication, granting the attacker code execution privileges on the affected endpoint.   

CWE: CWE‑284 Improper Access Control 

CVSS: Base score 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS 3.1).   

Affected versions: FortiClient EMS 7.4.5 and 7.4.6; later releases contain the fix.   

Vendor advisory:  FortiGuard security advisory FG‑IR‑26‑099 (https://fortiguard.fortinet.com/psirt/FG-IR-26-099).   

Public exposure: Listed in CISA’s KEV catalog on 6 April 2026; due date for mitigation is 9 April 2026. 

Impact 

Exploitation grants an unauthenticated attacker the ability to run arbitrary code on managed endpoints, potentially leading to full system compromise, lateral movement within corporate networks, and use of the compromised host in ransomware or other malicious campaigns. 

Mitigation Strategies 

1. Apply the FortiGuard patch referenced in advisory FG‑IR‑26‑099 immediately.   

2. Verify that all FortiClient EMS deployments are upgraded beyond version 7.4.6; retire any unpatched installations.   

3. Follow CISA guidance: implement BOD 22‑01 recommendations, review the “Hunt & Hardening Guidance for Fortinet Products,” and meet the KEV due date of 9 April 2026.   

4. Conduct an inventory of all FortiClient EMS assets using automated discovery tools and confirm remediation status before the deadline.   

5. Enable logging and monitor network traffic for anomalous FortiClient‑related requests that may indicate exploitation attempts. 

IMPORTANT NOTE: Deviation from CISA’s prescribed steps may invalidate compliance reporting and could trigger additional enforcement actions. 

Sources 

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35616
• https://nvd.nist.gov/vuln/detail/CVE-2026-35616
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616
• https://fortiguard.fortinet.com/psirt/FG-IR-26-099

Contributing Authors 

Dallas Myers: Director, Cybersecurity Services & R&D, Dataprise