CVE-2026-35616Active Exploitation(fortinet / forticlientems)

CRITICALCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 126 mentions and remains active

Immediate actions

Patch fortinet forticlientems systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

fortinet CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-04-09. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Patch / fix

https://fortiguard.fortinet.com/psirt/FG-IR-26-099

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616

Weakness type (CWE)

CWE-284

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

forticlientems

Threat summary

Active exploitation appears in 403 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
514 mentions across 62 observed days

What's happening

Active exploitation reported across 403 signals
Exploit tool or code specified in 14 signals
PoC mentioned or linked in 43 signals
Patch or workaround mentioned in 260 signals
Technical details provided in 292 signals
Disclosure: 41 classified signals
Peaked 59d ago at 126 mentions (2026-04-06); latest day: 1
514 total mentions across 62 days

Affected systems

Vendors

fortinet

Products

forticlientems

2 versions affected across 1 product

Deep dive

Activity timeline514 mentions / 62d

Signal classification6 categories

Active Exploitation

35569.1%

Patch

7214.0%

Disclosure

418.0%

General

356.8%

PoC

101.9%

Exploit

10.2%

Referenced assets294 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-04	34	Active Exploitation22Disclosure6General1Patch5
2026-04-05	80	Active Exploitation59Disclosure1General5Patch14PoC1
2026-04-06	126	Active Exploitation98Disclosure8General1Patch18PoC1
2026-04-07	62	Active Exploitation50Disclosure5General2Patch5
2026-04-08	13	Active Exploitation5Disclosure2General2Patch4
2026-04-09	7	Active Exploitation3Disclosure2Patch2
2026-04-10	10	Active Exploitation9Patch1
2026-04-11	2	Disclosure1General1
2026-04-12	3	Active Exploitation2General1
2026-04-13	8	Active Exploitation6Patch2
2026-04-14	2	Active Exploitation1Patch1
2026-04-15	11	Active Exploitation7General1Patch3
2026-04-18	2	Patch2
2026-04-19	1	Patch1
2026-04-20	5	Active Exploitation2Disclosure1Patch2
2026-04-21	6	Active Exploitation3General2Patch1
2026-04-22	4	Active Exploitation3Patch1
2026-04-23	1	Active Exploitation1
2026-04-24	3	Active Exploitation1Patch2
2026-04-25	1	PoC1
2026-04-27	2	Active Exploitation2
2026-04-28	1	Active Exploitation1
2026-04-29	1	Active Exploitation1
2026-04-30	1	Active Exploitation1
2026-05-01	1	General1
2026-05-04	1	Active Exploitation1
2026-05-05	1	Active Exploitation1
2026-05-06	7	Active Exploitation3Disclosure1Patch2PoC1
2026-05-07	2	Active Exploitation1PoC1
2026-05-09	5	Active Exploitation1PoC4
2026-05-11	1	PoC1
2026-05-12	2	Active Exploitation1Patch1
2026-05-13	1	Active Exploitation1
2026-05-15	6	Active Exploitation6
2026-05-21	3	Active Exploitation1General2
2026-05-22	2	Active Exploitation1Disclosure1
2026-05-27	3	Active Exploitation3
2026-05-28	26	Active Exploitation23Disclosure3
2026-05-29	17	Active Exploitation14General2Patch1
2026-05-30	5	Active Exploitation3Disclosure1General1
2026-05-31	1	Active Exploitation1
2026-06-01	4	Active Exploitation1Exploit1General2
2026-06-03	1	Active Exploitation1
2026-06-04	1	Active Exploitation1
2026-06-05	1	Active Exploitation1
2026-06-06	1	Patch1
2026-06-08	6	Active Exploitation6
2026-06-10	2	Active Exploitation1General1
2026-06-11	3	Active Exploitation2General1
2026-06-16	3	Active Exploitation1Disclosure2
2026-06-17	6	Active Exploitation1Disclosure2General3
2026-06-20	1	General1
2026-06-25	6	Active Exploitation1Disclosure4General1
2026-06-26	1	Disclosure1
2026-06-30	1	General1
2026-07-01	1	General1
2026-07-08	1	General1
2026-07-09	1	Patch1
2026-07-15	1	Active Exploitation1
2026-08-02	1	General1
2026-08-27	1	Patch1
2026-09-10	1	Patch1

Full discourse20 posts

Defused@DefusedCyber187d
Active Exploitation
🚨 New Fortinet vulnerability being exploited as an 0-day CVE-2026-35616 - FortiClient EMS pre-authentication API access bypass - CVSS 9.1 Critical After observing in-the-wild exploitation of this vulnerability earlier this week, Defused reported it to Fortinet under responsible disclosure. Fortinet has released an emergency hotfix - plus a scheduled patch - for FortiClient EMS 7.4.5 and 7.4.6. The vulnerability allows an unauthenticated attacker to bypass API authentication and authorization entirely, unauthorized code or commands via crafted requests. This discovery was made through our upcoming Radar feature launching next week 😇 Advisory: https://fortiguard.com/psirt/FG-IR-26-099 Track exploitation of this and other Fortinet vulns in real time and get updates on the new Defused Radar 👉 https://console.defusedcyber.com/signup Credit also to @heckintosh_ for independently discovering this vulnerability 💪
Post summary
CVE‑2026‑35616, a critical FortiClient EMS API authentication bypass, is actively exploited in the wild and has received an emergency hotfix and scheduled patch.
111111435115077.1K
7.3K followersView on X
International Cyber Digest@IntCyberDigest133d
Active Exploitation
‼️🚨 Hacked Fortinet FortiClient EMS servers are pushing infostealer malware disguised as a Fortinet patch to every managed endpoint. Attackers exploit CVE-2026-35616 to take the server, then abuse FortiClient's own management channel to deploy it. Patch now! https://t.co/i3Wb7fEuRK
Post summary
The tweet warns that attackers are exploiting CVE‑2026‑35616 to compromise Fortinet FortiClient EMS servers and push infostealer malware, and urges users to apply the available patch immediately.
867541012445.9K
193.5K followersView on X
dbugs@ptdbugs155d
PoC
🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-35616 PT ID: PT-2026-30288 Vendor: Fortinet Product: FortiClientEMS Description: A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Link: https://github.com/Alaatk/CVE-2026-35616 #dbugs_vuln
Post summary
A publicly released PoC/enabling exploit for CVE-2026-35616 demonstrates an improper access control flaw in FortiClientEMS that permits unauthenticated remote code execution, but there is no evidence of active exploitation or patch availability yet.
048124613619.1K
2.3K followersView on X
The Hacker News@TheHackersNews186d
Active Exploitation
⚠️ Fortinet is warning of active exploitation of CVE-2026-35616 (CVSS 9.1) in FortiClient EMS. The flaw lets unauthenticated attackers bypass API controls and run code. This is the second critical EMS flaw exploited in weeks. 🔗 Full details → https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html
Post summary
Fortinet warns that CVE-2026-35616 is being actively exploited in FortiClient EMS, allowing unauthenticated code execution via API bypass, with no patch or PoC mentioned.
79062714532.6K
1.6M followersView on X
NullSecurityX@NullSecurityX150d
PoC
FortiClient Endpoint Management Server authentication bypass (CVE-2026-35616) A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands.. https://github.com/Alaatk/CVE-2026-35616 https://t.co/yAgk2PSSJb
Post summary
The text highlights an authentication bypass vulnerability (CVE‑2026‑35616) in FortiClientEMS and provides a GitHub link that likely contains a proof‑of‑concept exploit, with no indication of active exploitation or available patch.
43301336610.0K
12.3K followersView on X
Cyber Security News@The_Cyber_News185d
Active Exploitation
🚨 CISA Warns of Fortinet 0-Day Vulnerability Actively Exploited in Attacks Source: https://cybersecuritynews.com/cisa-warns-fortinet-vulnerability/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-35616, a critical improper access control vulnerability in Fortinet FortiClient Enterprise Management Server (EMS), to its Known Exploited Vulnerabilities (KEV) catalog on April 6, 2026, mandating federal agencies to remediate by April 9, 2026. CVE-2026-35616 is a critical-severity flaw rooted in CWE-284 (Improper Access Control), carrying a CVSS score of 9.1. The vulnerability specifically affects FortiClient EMS versions 7.4.5 and 7.4.6, while the 7.2 branch remains unaffected. The flaw functions as a pre-authentication API access bypass, enabling privilege escalation without any valid credentials. #cybersecuritynews
Post summary
CISA has flagged Fortinet CVE-2026-35616 as an actively exploited vulnerability, noting its critical severity and impact on FortiClient EMS, but no patch or workaround information is provided.
44241473310.4K
65.9K followersView on X
Defused@DefusedCyber185d
Active Exploitation
🚨 We are now observing further exploitation of the recent FortiClient zero-day (CVE-2026-35616) No public POC exists to date, and this exploit has roughly the same structure as the observed zero-day exploit. To identify potential compromise, defenders should look for traffic from unknown IPs with the X-SSL-CLIENT-VERIFY header set to SUCCESS The two exploiting IP addresses to date: 51.79.66.]183 94.253.208.]16 Monitor exploits against Fortinet Forticlient EMS 👉 https://console.defusedcyber.com/intel
Post summary
FortiClient CVE‑2026‑35616 is being actively exploited in the wild, with two IP addresses implicated and a distinctive traffic header used for detection; however, no public PoC, exploit code, patch, or false‑positive claim is provided.
23211145727.2K
7.3K followersView on X
The Hacker News@TheHackersNews133d
Active Exploitation
⚠️ Threat actors are exploiting a critical FortiClient EMS flaw to push credential-stealing malware to entire networks of managed endpoints. CVE-2026-35616 (CVSS 9.1) allows pre-auth bypass and privilege escalation. Read full report: https://thehackernews.com/2026/05/threat-actors-exploit-critical.html
Post summary
Threat actors have discovered and are actively exploiting CVE‑2026‑35616 in FortiClient EMS to deploy credential‑stealing malware across managed endpoint networks.
63141062329.5K
1.9M followersView on X
Simo@SimoKohonen185d
General
CVE-2026-35616 has escaped the zero day orbit
Post summary
The brief statement indicates that CVE‑2026‑35616 is no longer treated as a zero‑day vulnerability, but no additional details on exploitation, mitigation, or technical aspects are provided.
2150571814.8K
3.2K followersView on X
The Hacker News@TheHackersNews132d
Active Exploitation
Threat actors exploited CVE-2026-35616 to modify FortiClient EMS configurations and silently push EKZ Infostealer across all managed endpoints. The payload was disguised as a legitimate “FortiEndpoint_Patch.exe” and executed through a Base64-encoded PowerShell script. It steals browser credentials, cookies, autofill data — and can enable follow-on access that sometimes bypasses MFA. Patch to FortiClient EMS 7.4.7 or newer immediately. Unpatched EMS servers can turn into a malware distribution platform for entire networks.
Post summary
CVE‑2026‑35616 is being actively exploited to distribute EKZ Infostealer across FortiClient EMS endpoints; patching to version 7.4.7 or newer is urgently required.
514162717.0K
1.9M followersView on X
CISA Cyber@CISACyber185d
Active Exploitation
🛡️ We added Fortinet FortiClient EMS improper access control vulnerability CVE-2026-35616 to our Known Exploited Vulnerabilities Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/uA0f8NRspV
Post summary
DHS highlights that CVE-2026-35616 in Fortinet FortiClient EMS is actively exploited, noting its inclusion in their Known Exploited Vulnerabilities Catalog.
62204448.4K
298.7K followersView on X
Dark Web Informer@DarkWebInformer133d
Disclosure
‼️ One Forged Header: Unauthenticated Authentication Bypass in Fortinet FortiClient EMS (CVE-2026-35616) https://darkwebinformer.com/one-forged-header-unauthenticated-authentication-bypass-in-fortinet-forticlient-ems-cve-2026-35616/
Post summary
The post references a disclosure of CVE-2026-35616, an unauthenticated authentication bypass in Fortinet FortiClient EMS, but provides no PoC, exploit code, or patch details.
172471811.2K
223.7K followersView on X
Defused@DefusedCyber171d
Active Exploitation
⚠️ We are observing an actor targeting FortiClient EMS fabric integration endpoints using a novel twist to the attack technique from CVE-2026-35616. Unlike the original campaign which targeted admin API access, this actor is attempting to register rogue FortiGate devices into the EMS trust fabric - a higher-impact attack path. Organizations running FortiClient EMS should consider restricting network access to the management interface regardless of patch status. Based on testing it seems the hotfix / patch successfully blocks this attack. IOCs and details on Defused Radar 👉 http://console.defusedcyber.com/radar
Post summary
Defused Cyber reports an active threat actor exploiting CVE‑2026‑35616 via rogue FortiGate registration into the FortiClient EMS trust fabric, and a hotfix/patch that blocks the attack has been confirmed.
41514697.0K
7.4K followersView on X
Cristian Borghello@SeguInfo176d
General
Como diría alguien (de #Fortinet): "que MAL que la estoy pasando"😤 - CVE-2026-21643 - Inyección SQL (9.1) - CVE-2026-35616 - Control de acceso inadecuado (9.1) - CVE-2026-39808 - Ejecución de comandos (9.1) 🔗https://blog.segu-info.com.ar/2026/04/otra-vulnerabilidad-critica-rce-en.html PARCHEA!
Post summary
The post lists three high‑severity CVEs and urges patching, but offers no exploit details, PoC or vendor mitigation specifics.
012038152.9K
38.3K followersView on X
The Shadowserver Foundation@Shadowserver186d
Active Exploitation
Heads up FortiClient EMS users! CVE-2026-35616 (new) & CVE-2026-21643 - both unauthenticated RCE observed to be exploited in the wild! We fingerprint about 2000 instances globally, see public Dashboard: https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=30&vendor=fortinet&model=forticlient+enterprise+management+server+%28ems%29&dataset=count&limit=100&group_by=geo&stacking=stacked&auto_update=on Top affected: US & Germany https://dashboard.shadowserver.org/statistics/iot-devices/map/?date_range=1&vendor=fortinet&model=forticlient+enterprise+management+server+%28ems%29&data_set=count&scale=log&auto_update=on https://t.co/tLOs6mhgBk
Post summary
The post warns FortiClient EMS users that CVE-2026-35616 and CVE-2026-21643 are currently being exploited worldwide, providing a dashboard link for affected distributions but offering no patches or PoC details.
114133158.5K
21.8K followersView on X
Simo@SimoKohonen186d
General
Many asking about POC / IOCs for CVE-2026-35616 (the FortiClient 0-day) Outside of informing @defused customer base who deal with detection engineering, I haven't released much info about it It's really really easy to exploit and I'm entirely sure a good bunch of Fortinet admins haven't patched given its the weekend plus a major holiday Also haven't seen further exploitation in our honeypots thus far. Quite sure someone will reverse it soon but if not and / or more exploits start happening will publish details early into the week to give people a plausible chance to patch it
Post summary
The post references FortiClient CVE‑2026‑35616, states no evidence of exploitation yet, and plans to release more detail if needed, but offers no actionable information.
34044117.4K
3.2K followersView on X
Censys@censysio184d
Active Exploitation
🚨 Critical vulnerability: CVE-2026-35616 is an improper access control vulnerability affecting Fortinet FortiClient EMS (CVSS v3.1 9.1). Allows unauthorized code & command execution from remote unauthenticated attackers. ⚠️ Actively exploited in the wild 🛠️ Hotfix available If you are running these devices, treat your Internet-exposed EMS management surfaces as high risk until patched and consider restricting access to trusted networks where possible. 🔗 Learn more in the full advisory: https://hubs.ly/Q049SVt30 #CensysARC #CVE202635616
Post summary
CVE-2026-35616 is an improperly controlled access flaw in Fortinet FortiClient EMS, actively exploited in the wild, with a hotfix already released. Users are advised to patch promptly or restrict network access.
011025133.0K
12.4K followersView on X
Caitlin Condon@catc0n187d
Active Exploitation
CVE-2026-35616 is now on VulnCheck KEV ✅
Post summary
CVE-2026-35616 has been added to VulnCheck KEV, signifying it is actively exploited in the wild.
1813098.1K
3.6K followersView on X
Clandestine@akaclandestine154d
PoC
GitHub - Alaatk/CVE-2026-35616: Fortinet FortiClientEMS improper access control · GitHub https://github.com/Alaatk/CVE-2026-35616
Post summary
A public GitHub repository (Alaatk/CVE-2026-35616) appears to host proof‑of‑concept exploit code for Fortinet FortiClientEMS improper access control, but no evidence of live exploitation or remediation is presented.
14032103.7K
62.1K followersView on X
Dmitry Melikov@DmitriyMelikov134d
Active Exploitation
Unattributed TA use CVE-2026-35616 in FortiClient EMS to deploy #EKZInfostealer Details, #iocs, and Rules are inside. ⬇️ https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/ #Infostealer #cybersecurity @AWNetworks https://t.co/UhuwD50pV3
Post summary
The post reports that threat actors have actively exploited CVE-2026-35616 in FortiClient EMS to deliver the EKZ Infostealer, with a link to documentation containing IOCs and deployment rules.
09027102.8K
2.2K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	fortinet	forticlientems	7.4.5	-	-
App	fortinet	forticlientems	7.4.6	-	-

Explore more

Back to dashboard fortinet CVEs forticlientems vulnerabilities

What researchers are saying

CVE-2026-35616

International Cyber Digest[verified]@IntCyberDigestActive Exploitation

The tweet warns that attackers are exploiting CVE‑2026‑35616 to compromise Fortinet FortiClient EMS servers and push infostealer malware, and urges users to apply the available patch immediately.

dbugs[verified]@ptdbugsPoC

A publicly released PoC/enabling exploit for CVE-2026-35616 demonstrates an improper access control flaw in FortiClientEMS that permits unauthenticated remote code execution, but there is no evidence of active exploitation or patch availability yet.

NullSecurityX[verified]@NullSecurityXPoC

The text highlights an authentication bypass vulnerability (CVE‑2026‑35616) in FortiClientEMS and provides a GitHub link that likely contains a proof‑of‑concept exploit, with no indication of active exploitation or available patch.

Cyber Security News[verified]@The_Cyber_NewsActive Exploitation

CISA has flagged Fortinet CVE-2026-35616 as an actively exploited vulnerability, noting its critical severity and impact on FortiClient EMS, but no patch or workaround information is provided.

Simo[verified]@SimoKohonenGeneral

The brief statement indicates that CVE‑2026‑35616 is no longer treated as a zero‑day vulnerability, but no additional details on exploitation, mitigation, or technical aspects are provided.

Simo[verified]@SimoKohonenGeneral

The post references FortiClient CVE‑2026‑35616, states no evidence of exploitation yet, and plans to release more detail if needed, but offers no actionable information.

Censys[verified]@censysioActive Exploitation

CVE-2026-35616 is an improperly controlled access flaw in Fortinet FortiClient EMS, actively exploited in the wild, with a hotfix already released. Users are advised to patch promptly or restrict network access.

Clandestine[verified]@akaclandestinePoC

A public GitHub repository (Alaatk/CVE-2026-35616) appears to host proof‑of‑concept exploit code for Fortinet FortiClientEMS improper access control, but no evidence of live exploitation or remediation is presented.