Signal

Fortinet urgently patches actively exploited zero-day vulnerability in FortiClient EMS

Evidence first: scan the strongest sources, then decide whether to go deeper.

Published 2026-04-06 09:37 UTCUpdated 2026-04-07 15:09 UTC

rss

cveexploitssecurity_toolingincident_responsesecurity_advisories

Source links open

Source links and full evidence are open here. Pro adds archive history, compare-over-time, alerts, exports, and workflow. Business adds Feed API integrations and team usage.

Back Evidence (7)Get the free brief by email Start free trial

No card needed for the free brief.

Evidence trail (top sources)

top sources (4 domains)

4 top sources shown

Warning: Critical CVE-2026-35616 is actively exploited, allowing attackers to gain unauthorized access and potentially achieve remote code execution, Patch Immediately!

Belgium · ccb.belgium.be · 2026-04-07 15:09 UTC

Fortinet security advisory (AV26-313)

Gc · cyber.gc.ca · 2026-04-07 12:02 UTC

Fortinet Releases Emergency Patch After FortiClient EMS Bug Is Exploited

Infosecurity Magazine · infosecurity-magazine.com · 2026-04-07 09:26 UTC

ALERT FortiClientEMS: CVSS (Max): 9.8

Auscert · portal.auscert.org.au · 2026-04-07 01:48 UTC

View all evidence

Overview

Fortinet has released an emergency hotfix to address a critical zero-day vulnerability (CVE-2026-35616) in its FortiClient Enterprise Management Server (EMS) software.

Entities

FortinetFortiClient EMSBenjamin Harris

Score total

1.62

Momentum 24h

Evidence documents

Independent publishers

Independent origins

Primary sources

Secondary sources

Source types

Duplicate ratio

Why now

Exploitation attempts began March 31 and have increased following public disclosure.
Fortinet’s emergency hotfix was released only recently, with a full patch pending.
CISA’s addition of the CVE to its Known Exploited Vulnerabilities catalog highlights urgency for defenders.

Why it matters

The vulnerability is actively exploited, posing immediate risk to organizations using FortiClient EMS.
High severity (CVSS 9.8) indicates potential for severe impact including remote code execution.
Prompt patching is critical to prevent unauthorized access and further compromise.

LLM analysis

Topic mix: lowPromo risk: lowSource quality: medium

Recurring claims

CVE-2026-35616 is a critical zero-day vulnerability actively exploited in the wild affecting FortiClient EMS.
Fortinet released an emergency hotfix over the Easter weekend and plans a more comprehensive patch later.
The vulnerability allows API authentication and authorization bypass, leading to unauthorized access and potential remote code execution.

How sources frame it