Urgent alert: FortiClient EMS Zero-Day vulnerability under active exploitation

Fortinet has released an emergency security update to address a critical zero-day vulnerability in its FortiClient Enterprise Management Server (EMS). This flaw is currently being exploited in the wild, posing a significant risk to organizations' internal infrastructures and endpoint security management globally.

Technical Analysis and Impact (CVE-2026-35616)

The vulnerability, tracked as CVE-2026-35616, has been assigned a CVSS score of 9.1 (Critical). It is categorized as an "Improper Access Control" flaw within the system's Application Programming Interface (API).

• Vulnerability Type: Pre-authentication API access bypass.

• Impact: An unauthenticated remote attacker can send specially crafted requests to the FortiClient EMS server. This bypasses authentication mechanisms, potentially leading to Remote Code Execution (RCE) or full administrative takeover of the management server.

• Affected Versions: Organizations running FortiClient EMS versions 7.4.5 and 7.4.6 are at immediate risk and are urged to prioritize patching.

Zero-day vulnerability in FortiClient EMS (CVE-2026-35616)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-35616 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies and advising private sectors to remediate the flaw before April 9, 2026.

Exploitation Context and Supply Chain Risks

Security researchers from WatchTowr and expert Nguyen Duc Anh (who is credited with the discovery) noted that exploitation attempts began surfacing as early as late March 2026.

The primary danger lies in the strategic role of the EMS server. As the central hub for endpoint management, a compromised EMS can serve as a "launchpad" for attackers to push malicious payloads to thousands of connected endpoints across the corporate network, effectively turning a single breach into a widespread supply chain incident.

This incident follows a pattern of high-severity flaws in the product line, such as CVE-2026-21643 (a SQL injection flaw), indicating that FortiClient EMS remains a high-value target for sophisticated threat actors.

The Cybersecurity Landscape in April 2026

www.ipsip.vn

2025 Cybersecurity Report & 2026 Strategic Outlook

According to the 2025 Cybersecurity Reports from industry leaders such as CrowdStrike and Huntress, we are now facing "Evasive Adversaries"—threat actors capable of responding and pivoting in mere seconds.

In Vietnam, cybersecurity monitoring sensors have detected a sharp increase in automated scanning activities targeting EMS management ports exposed to the public internet. In the era of AI-driven search and automation, the "window of opportunity" between vulnerability disclosure and weaponized Proof-of-Concept (PoC) exploits has narrowed to mere hours.

"Cybercrime in 2026 is no longer opportunistic; it is an industrialized operation moving at machine speed through AI," noted industry experts during the recent security summit in Hanoi.

Technical Mitigation and Recommendations

To secure infrastructures against this Zero-day threat, administrators should follow this technical roadmap:

1. Immediate Firmware Upgrade: Transition to FortiClient EMS version 7.4.7 or apply the specific hotfixes provided by Fortinet. This is the only definitive resolution for the vulnerability.

2. Indicators of Compromise (IoC) Review: Systematically audit API access logs on the EMS server for anomalous requests originating from unrecognized or external IP addresses.

3. Network Hardening: Restrict access to the EMS management interface. Implement firewall rules to allow only trusted IP ranges or enforce connections via VPN/SASE with Multi-Factor Authentication (MFA).

4. Least Privilege Implementation: Audit and restrict API service account permissions. Rotate all administrative credentials immediately after the patch is applied.

Additional Reference Information: If an immediate update is not feasible due to operational constraints, administrators should deploy a Web Application Firewall (WAF) configured with signatures to detect and block malicious API request patterns targeting FortiClient EMS as a temporary mitigation measure.

-----

References:

• Dark Reading: Fortinet Issues Emergency Patch for FortiClient Zero-Day (April 2026).

• The Hacker News: Fortinet patches actively exploited CVE-2026-35616.

• FortiGuard Labs: Security Advisory - CVE-2026-35616.