FortiClient EMS Security Incident

A zero-day vulnerability (CVE-2026-35616) affecting FortiClient EMS has been actively exploited, necessitating the urgent release of emergency hotfixes. This critical flaw allows attackers to compromise enterprise management systems before a patch is widely available.

What Happened

A zero-day vulnerability (CVE-2026-35616) affecting FortiClient EMS has been actively exploited, necessitating the urgent release of emergency hotfixes. This critical flaw allows attackers to compromise enterprise management systems before a patch is widely available.

Why This Matters

Publisher reporting describes a security event affecting New. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether New is present in your environment, compare your versions against the report, and apply available vendor patches or mitigations.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: ACTIVELY_EXPLOITED

Primary entities:

Authoritative Intelligence

EPSS is a vulnerability exploitation probability signal, not proof that your environment is exposed. CISA KEV means known exploitation of the vulnerability, not that your system was exploited.

Public GitHub References

Search GitHub for public repositories that mention this CVE. BugSkan only lists repository metadata as a defensive awareness signal — it does not fetch or display exploit code.

Timeline

• Incident first seen
  Apr 03, 2026 05:30

  BugSkan first recorded this incident.

• New infosec products of the month: March 2026 - Help Net Security
  Apr 03, 2026 05:30

  helpnetsecurity.com · Vulnerability

Sources

Related Incidents

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match