Last seen April 3, 2026

FortiClient EMS Security Incident

A zero-day vulnerability (CVE-2026-35616) affecting FortiClient EMS has been actively exploited, necessitating the urgent release of emergency hotfixes. This critical flaw allows attackers to compromise enterprise management systems before a patch is widely available.

Technical Severity
Medium severity
Lifecycle Status

STABLE

Sources

What Happened

A zero-day vulnerability (CVE-2026-35616) affecting FortiClient EMS has been actively exploited, necessitating the urgent release of emergency hotfixes. This critical flaw allows attackers to compromise enterprise management systems before a patch is widely available.

Why This Matters

Publisher reporting describes a security event affecting New. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether New is present in your environment, compare your versions against the report, and apply available vendor patches or mitigations.

Exposure

My Interests Exposure

Exposure unknown

Recommended Response
Last Seen

Apr 03, 2026 05:30

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: ACTIVELY_EXPLOITED

Primary entities:

FortiClient EMSMarchNewCVE-2026-35616zero-day

Authoritative Intelligence

CVE CVE-2026-35616 Incident identifier

EPSS is a vulnerability exploitation probability signal, not proof that your environment is exposed. CISA KEV means known exploitation of the vulnerability, not that your system was exploited.

Public GitHub References

Search GitHub for public repositories that mention this CVE. BugSkan only lists repository metadata as a defensive awareness signal — it does not fetch or display exploit code.

CVE-2026-35616 on GitHub

CVE-2026-35616: 6 public repository references found.

fevar54/forticlient_ems_cve_2026_35616_poc.py

Possible public PoC reference

PoC de CVE-2026-35616: control de acceso indebido en FortiClient EMS.

0 stars · Python

Open repository
fevar54/CVE-2026-35616-detector.py

Public GitHub reference

Detector de CVE-2026-35616: identifica servidores FortiClient EMS vulnerables (7.4.5-7.4.6).

0 stars · Python

Open repository
Alaatk/CVE-2026-35616

Public GitHub reference

Fortinet FortiClientEMS improper access control

37 stars · Python

Open repository
BishopFox/CVE-2026-35616-check

Public GitHub reference

GitHub repository for an AI tooling project

2 stars · Python

Open repository
keraattin/CVE-2026-35616

Public GitHub reference

CVE-2026-35616 - FortiClient EMS Pre-Authentication API Bypass (CVSS 9.1, CISA KEV). Python & Nmap NSE detection scripts with full technical breakdown. One forged HTTP header bypasses authentication on FortiClient EMS 7.4.5–7.4.6, granting full admin API access to all managed endpoints.

1 stars · Python

Open repository
wa6n3r/CVE-2026-35616

Public GitHub reference

GitHub repository for an AI tooling project

1 stars · Python

Open repository

A public PoC or exploit-related repository means weaponization material may exist in the open. It does not prove your environment was targeted.

Timeline

  • Incident first seen
    Apr 03, 2026 05:30

    BugSkan first recorded this incident.

  • New infosec products of the month: March 2026 - Help Net Security
    Apr 03, 2026 05:30

    helpnetsecurity.com · Vulnerability

Sources

New infosec products of the month: March 2026 - Help Net Security

helpnetsecurity.com · Apr 03, 2026 05:30

A zero-day vulnerability (CVE-2026-35616) affecting FortiClient EMS has been actively exploited, necessitating the urgent release of emergency hotfixes. This critical flaw allows attackers to compromise enterprise management systems before a patch is widely available.

Open publisher source

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match

Want personalized relevance?

Create an account to see which incidents overlap with your interests.

← Back to incident intelligence