CVE-2026-35616
Fortinet FortiClientEMS versions 7.4.5 and 7.4.6 contain a critical access‑control flaw that lets unauthenticated attackers run arbitrary code on the affected system. The vulnerability can be exploited without any user interaction, giving attackers full control over the device. Fortinet has released mitigations that must be applied to protect users.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Fortinet FortiClientEMS 7.4.5 and 7.4.6 users, typically enterprise customers using Fortinet's endpoint management solution.
Real-world impact
An attacker could take full control of a device running FortiClientEMS, executing any code or commands, potentially compromising the entire network or exfiltrating data.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network, requires no authentication or user interaction, and gives attackers complete control over confidentiality, integrity, and availability.
What to do about it
- 01Apply the vendor‑provided mitigation for FortiClientEMS 7.4.5 and 7.4.6 as described by Fortinet.
- 02Follow BOD 22‑01 guidance for cloud services.
- 03If mitigations are unavailable, discontinue use of the product.
CISA KEV required action
Timeline
- Apr 4, 2026 · Apr 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Apr 6, 2026 · Apr 6, 2026Confirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Apr 9, 2026 · Apr 9, 2026CISA remediation deadlineFederal agencies are required to remediate by this date.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- fortiguard.fortinet.com/psirt/FG-IR-26-099patchvendor advisory
- cisa.gov/known-exploited-vulnerabili…us government resource