FortiClient EMS Critical Zero-Day CVE-2026-35616 Actively Exploited - Patch Now

Overview/Introduction

On April 5, 2026, Fortinet disclosed a critical vulnerability in its FortiClient Endpoint Management Server (EMS) - CVE-2026-35616. The flaw, rated 9.1 on the CVSS v3.1 scale, permits an unauthenticated attacker to bypass API authentication and execute arbitrary code on the management server. Fortinet confirmed that exploitation attempts have been observed in the wild since March 31, 2026, prompting the release of an out-of-band hotfix for the affected 7.4.5 and 7.4.6 releases. A full remediation is slated for the upcoming 7.4.7 version.

Technical Details

The vulnerability is classified as an Improper Access Control issue (CWE-284). FortiClient EMS exposes a RESTful API used by the console, agents, and third-party integrations. The API implementation fails to enforce authentication checks on certain endpoints that handle configuration changes and command execution. An attacker can craft HTTP requests that directly invoke these privileged functions without presenting valid credentials.

CVE Identifier and Scoring

• CVE-2026-35616
• CVSS v3.1 Base Score: 9.1 (Critical)
• Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None
• Impact: Confidentiality, Integrity, Availability

Attack Vector

The attack surface is the public-facing API endpoint, typically reachable on TCP port 8013 (HTTPS). No prior authentication token or session cookie is required. The exploit chain follows these steps:

1. Identify a reachable FortiClient EMS instance (e.g., via Shodan or internal scanning).
2. Send a crafted HTTP POST to /api/v1/command/exec with a JSON payload containing the command to run.
3. The server processes the request without validating the caller’s identity.
4. The command is executed with the privileges of the EMS service account (often SYSTEM/root).
5. Attacker receives the command output in the HTTP response.

Because the service runs with elevated privileges, the attacker can install backdoors, manipulate endpoint policies, or pivot laterally into the corporate network.

Exploitation Method Observed in the Wild

Threat intelligence feeds (watchTowr, Defused Cyber) reported that the first exploitation attempts were captured on honeypots on March 31, 2026. The payloads observed leveraged the /api/v1/command/exec endpoint to launch PowerShell scripts on Windows-based EMS servers and Bash commands on Linux-based deployments. The scripts performed the following actions:

• Download and execute a second-stage payload from a C2 server.
• Create a new local admin user on the EMS host.
• Export the EMS configuration and exfiltrate it via HTTPS.

These activities indicate a sophisticated, possibly nation-state or well-funded cyber-crime group, capable of automated scanning and exploitation at scale.

Impact Analysis

The vulnerability directly affects FortiClient EMS versions 7.4.5 and 7.4.6. Enterprises that deploy EMS for endpoint protection, policy distribution, and remote management are at risk. The impact can be broken down into three core areas:

• Confidentiality: Attackers can retrieve configuration files, endpoint inventories, and authentication certificates.
• Integrity: Malicious commands can alter security policies, disable AV signatures, or whitelist malicious binaries on managed endpoints.
• Availability: An attacker could stop the EMS service, disrupt endpoint updates, or cause a denial-of-service condition across the managed fleet.

Given the EMS’s central role in enterprise security posture, a successful exploit could effectively neutralize an organization’s endpoint defenses, providing a foothold for further intrusion.

Timeline of Events

• March 31, 2026: watchTowr records first exploitation attempts on its honeypot network.
• April 2, 2026: Defused Cyber publicly announces observation of zero-day activity targeting FortiClient EMS.
• April 4, 2026: Fortinet’s internal security team confirms active exploitation and initiates emergency response.
• April 5, 2026: Fortinet releases an out-of-band hotfix for EMS 7.4.5 and 7.4.6, and publishes an advisory detailing CVE-2026-35616.
• April 6, 2026 (today): Security community begins wide-scale deployment of the hotfix; analysts note a second critical FortiClient EMS flaw (CVE-2026-21643) was patched weeks earlier.

Mitigation/Recommendations

Enterprises should treat CVE-2026-35616 as an emergency. The following steps are recommended:

1. Apply the Hotfix Immediately: Download and install the out-of-band hotfix for EMS 7.4.5/7.4.6 from Fortinet’s support portal. Verify the installation with show version on the EMS console.
2. Restrict API Exposure: If the EMS API does not need to be Internet-facing, place it behind a VPN or restrict access to trusted IP ranges using firewall rules.
3. Enable Mutual TLS (mTLS): Enforce client certificate authentication for all API calls to add a second layer of verification.
4. Monitor Logs Aggressively: Enable detailed audit logging for /api/v1/command/exec and set up SIEM alerts for any unexpected command execution payloads.
5. Network Segmentation: Isolate the EMS server on a dedicated management VLAN with no direct outbound Internet access.
6. Patch Management: Plan for the upcoming 7.4.7 release, which contains a permanent fix. Schedule a controlled upgrade after testing in a staging environment.
7. Incident Response: Conduct a forensic review of EMS logs from the past week to detect potential compromise. If compromise is suspected, assume the EMS host is fully breached and rebuild from clean images.

Real-World Impact

For organizations that rely on FortiClient EMS to manage thousands of endpoints, the vulnerability translates into a direct pathway to neutralize endpoint protection across the entire network. A compromised EMS can:

• Disable anti-malware signatures, allowing ransomware to spread unchecked.
• Push malicious policies that whitelist attacker-controlled executables.
• Exfiltrate sensitive data from managed devices via the EMS’s built-in reporting mechanisms.

Financial services, healthcare, and critical infrastructure sectors, which often have strict compliance requirements, could face regulatory penalties if the breach leads to data loss. Moreover, the timing-following the Easter holiday weekend-matches attacker patterns of exploiting reduced staffing levels, amplifying the potential damage.

Expert Opinion

From a strategic standpoint, CVE-2026-35616 underscores a broader trend: the increasing attack surface of security-oriented management platforms. These products are traditionally trusted as “control towers,” yet they expose powerful APIs that, if not hardened, become high-value targets. The rapid emergence of two critical, unauthenticated flaws in FortiClient EMS within weeks suggests systemic design oversights in Fortinet’s API security model.

Enterprises should reassess their reliance on single-vendor management stacks and consider defense-in-depth measures such as:

• Zero-trust network segmentation for management interfaces.
• Regular independent code reviews or third-party penetration testing of API endpoints.
• Adoption of “least-privilege” service accounts for EMS processes.

Finally, the industry must push vendors toward secure development lifecycles that include mandatory authentication enforcement for every API call, even those deemed “internal.” The FortiClient EMS case will likely become a reference point for future compliance audits and may influence upcoming standards around API security for security-operations platforms.