Critical [CVE-2026-35616] API authentication and authorization bypass
This critical-severity Fortinet advisory covers CVE-2026-35616 affecting FortiClient.
Android app · Google Play
Monitor future Fortinet CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
CVSSv3 Score: 9.1 An Improper Access Control vulnerability [CWE-284] in FortiClient EMS may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6, by following the instructions at: - for FortiClientEMS 7.4.5https://docs.fortinet.com/document/forticlient/7.4.6/ems-release-notes/832484 - for FortiClientEMS 7.4.6Upcoming FortiClientEMS 7.4.7 will also include a fix for this issue.
In the meantime the hotfix above is sufficient to prevent it entirely. Revised on 2026-04-04 00:00:00
CISA Known Exploited Vulnerability
- Listed:
- Apr 6, 2026 · federal remediation due Apr 9, 2026
- Required action:
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Ransomware use:
- Unknown
KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.
- 7.4.5
- 7.4.6
- 7.4.7
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- FortiClientEMS 7.4: 7.4.7
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Upgrade per the Affected/Solution table: FortiClientEMS 7.4: 7.4.7.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.