VulnerabilityALERT High

CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerability

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Impact

CISA lists CVE-2026-35616 as known exploited in the wild for Fortinet FortiClient EMS. Ransomware campaign use: Unknown. Federal remediation due date: 2026-04-09.

Recommended Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Published: 4/6/2026, 12:00:00 AMSource: CISA Known Exploited Vulnerabilities CatalogTags: CVE-2026-35616, Fortinet, FortiClient EMS, CISA KEV, CWE-284