CVE-2026-35616

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-099 ; https://nvd.nist.gov/vuln/detail/CVE-2026-35616

Remediation deadline: April 9, 2026

Description

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Timeline

Published:April 6th, 2026 12:00 AM

Last modified:April 6th, 2026 12:00 AM

Added to KEV:April 6th, 2026

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

Fortinet

Products

FortiClient EMS

Weaknesses (CWE)

CWE-284

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute