Fortinet disclosed a critical FortiClient EMS vulnerability that is already being exploited in the wild.
The flaw could allow unauthenticated attackers to bypass API protections and execute unauthorized code or commands on exposed systems.
“This is a zero-day. While there is no full patch, we have to give credit where credit is due: Fortinet has rushed out a hotfix over a holiday weekend, which reflects how urgently the company is treating this,” said Benjamin Harris, CEO and founder of watchTowr, in an email to eSecurityPlanet.
He added, “watchTowr’s Attacker Eye honeypot infrastructure is currently capturing active exploitation of CVE-2026-35616. Attacker Eye sensors first captured exploitation activity on March 31st, days before today’s public disclosure, in what appeared to be early probes ahead of a full ramp-up.”
Inside the FortiClient EMS vulnerability
FortiClient EMS should be treated as critical management infrastructure, not just another endpoint tool. It sits in a highly privileged position within the enterprise, responsible for managing, configuring, and enforcing security controls across endpoint fleets.
If attackers gain control of this layer, they may be able to interfere with endpoint protections, push malicious configurations, execute commands at scale, or abuse administrative trust to move laterally across the environment.
The flaw, CVE-2026-35616, affects recently deployed versions of FortiClient EMS, and Fortinet has already issued hotfixes while customers await a permanent fix in an upcoming release. This also marks the second critical FortiClient EMS vulnerability to be actively exploited in recent months, following CVE-2026-21643.
While it is not yet clear whether the same threat actor is behind both campaigns or whether the vulnerabilities are being chained together, the pattern suggests attackers are actively probing FortiClient EMS as a high-value entry point into enterprise environments.
Breakdown of CVE-2026-35616
CVE-2026-35616 is a pre-authentication API access bypass that can lead to privilege escalation, with a CVSS score of 9.1.
The root cause is improper access control, which allows attackers to send specially crafted API requests that bypass authentication and authorization checks. Basically, the system fails to properly verify whether a request should be allowed, opening the door to unauthorized actions.
This combination lowers the barrier to exploitation, as the pre-authentication vulnerability allows attackers to interact with the target system without valid credentials.
If the EMS instance is reachable — particularly if it is exposed to the internet or insufficiently segmented — attackers can directly attempt to exploit it, moving from access bypass to unauthorized command execution.
Reducing risk in EMS environments
To reduce the risk of exploitation, organizations should enforce appropriate access controls in EMS environments.
- Apply the latest hotfix and validate that the fix has been successfully implemented.
- Restrict EMS access to trusted internal networks, VPNs, or jump boxes and remove unnecessary internet exposure.
- Place EMS behind firewall allowlists or access control lists to limit API and administrative access.
- Review logs and telemetry for suspicious API activity, unauthorized commands, or anomalous administrative behavior.
- Monitor the EMS host for signs of persistence, including new services, scheduled tasks, scripts, or unexpected outbound connections.
- Audit and reduce the number of privileged accounts, service accounts, and API permissions, and rotate credentials if a compromise is suspected.
- Test incident response and disaster recovery plans to ensure teams can quickly contain and rebuild EMS infrastructure if needed.
Together, these measures help build resilience and limit the blast radius of any potential compromise.
Editor’s note: This article originally appeared on our sister publication, eSecurityPlanet.