CVE-2026-35616: FortiClient EMS Patch and Response Guide
FortiClient EMS 7.4.5 and 7.4.6 are affected by actively exploited CVE-2026-35616. Check the fixed versions, hotfix paths, and response steps.
Primary source: authoritative reference
CVE-2026-35616 is a critical improper-access-control vulnerability in Fortinet FortiClient Endpoint Management Server (EMS). Fortinet says an unauthenticated attacker can execute unauthorized code or commands through crafted requests. The affected server releases are 7.4.5 and 7.4.6.
This issue applies to the EMS management server, not every FortiClient endpoint installation simply because it carries a 7.4.x version number. Inventory the EMS servers you operate and check their complete build and hotfix status.
CVE-2026-35616 at a glance
| Item | Verified information | | --- | --- | | Affected product | FortiClient EMS | | Affected releases | 7.4.5 through 7.4.6 | | Fixed release | 7.4.7 or later; Fortinet's CVE record also lists 8.0.0 or later | | Hotfix path | Fortinet documents GA hotfix 1 for both affected releases | | Attack prerequisites | Network reachable, no privileges, no user interaction | | Known exploitation | Yes; CISA added the CVE to its Known Exploited Vulnerabilities catalog on April 6, 2026 |
The score can look inconsistent across databases. Fortinet's CVE record reports 9.1 with temporal metrics included, while NVD displays the same CNA vector's 9.8 base score. Both are Critical. For prioritization, the affected versions and confirmed KEV status matter more than choosing one headline number.
What administrators should do now
1. Identify every EMS server and its exact state
Record the EMS release, build, and installed hotfixes for each deployment. Do not infer the server version from managed endpoint agents. Fortinet's release notes identify these fixed hotfix builds:
- FortiClient EMS 7.4.5 GA hotfix 1:
7.4.5.2111.1277073 - FortiClient EMS 7.4.6 GA hotfix 1:
7.4.6.2170.1277073
If an affected server cannot be confirmed as patched, treat it as exposed until verified.
2. Apply the vendor-supported fix
Prefer upgrading EMS to 7.4.7 or later according to Fortinet's supported upgrade path. If an immediate release upgrade is not possible, obtain and apply the correct EMS hotfix through Fortinet's supported distribution and installation process.
Do not substitute a FortiClient endpoint-agent update for the EMS server fix. Back up the deployment, review the release-specific upgrade notes, and plan for the service restart described in Fortinet's hotfix instructions.
3. Reduce exposure while remediation is in progress
Restrict access to the EMS management surface to authorized administration networks and users. Use existing firewall, private-access, or VPN controls rather than exposing the management server broadly. This is a temporary risk reduction measure, not a replacement for the patch.
4. Verify the result
After remediation:
- Confirm the running EMS release and build.
- If using a hotfix, use Fortinet's documented hotfix-list command and confirm its status is
applied. - Verify that EMS services and expected endpoint-management functions recover normally.
- Preserve the change record, backup reference, and verification evidence for incident review.
How to investigate possible compromise
CISA's KEV listing establishes that exploitation has occurred, but the public vendor record does not provide a universal set of indicators or a safe public exploit test. Avoid treating an arbitrary URL, status code, or copied community scanner as proof that a server is clean.
Preserve and review the evidence your deployment actually has, including:
- EMS administrative-account creation and role changes
- unexpected policy, installer, deployment, connector, or configuration changes
- authentication and authorization anomalies in EMS and its reverse proxy or access layer
- unusual management requests or source addresses around the exposure window
- unexpected server processes, scheduled tasks, files, or outbound connections
Compare activity against your own administrator and maintenance records. If the evidence suggests unauthorized access, isolate the server using the organization's incident-response process, preserve forensic data, and rotate credentials or tokens that the compromised EMS host could access. Patching stops the known vulnerability; it does not undo prior compromise.
What this advisory does not establish
The public Fortinet and CVE records describe the vulnerability's class, affected versions, impact, and fixes. They do not publicly document the exact vulnerable endpoint, the complete exploit chain, or one authoritative indicator set. This guide therefore does not reproduce speculative request paths, payloads, log signatures, or claims about the attacker's implementation.
The vulnerability is an EMS access-control failure. It is not evidence that JWT, OAuth, an API gateway, or a specific application framework caused the defect. General authentication guidance can be useful, but it should not be presented as the confirmed root cause of this CVE.
Share investigation artifacts carefully
Logs and configuration excerpts can contain authorization headers, API keys, passwords, cookies, and internal URLs. Before sharing a small text excerpt with a vendor or teammate, the browser-local Safe-to-Share Sanitizer can help mask common secret shapes. Detection is heuristic: review the result manually and use the organization's approved secure transfer channel for full forensic packages.
For the broader difference between token decoding and security validation, see JWT Vulnerabilities: Validation Failures, HS256 Risks, and Defenses.