What is the CVSS score of CVE-2026-35616?

CVE-2026-35616 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Forticlientems are affected by CVE-2026-35616?

Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems.

Is there a public PoC exploit available for CVE-2026-35616?

Yes, a public proof-of-concept exploit is available for CVE-2026-35616. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-35616?

Within 24 hours: Identify all FortiClientEMS installations and confirm versions 7.4.5 and 7.4.6 inventory; contact Fortinet for available patches or interim versions. Within 7 days: Apply vendor-released patch immediately upon availability; if unavailable, isolate affected FortiClientEMS servers from untrusted networks and restrict network access to administrative personnel only. Within 30 days: Complete deployment of patched FortiClientEMS version across all instances; conduct forensic analysis of systems for unauthorized access during unpatched exposure period.

Forticlientems CVE-2026-35616

EUVD-2026-18963 CRITICAL

Improper Access Control (CWE-284)

2026-04-04 fortinet

Authentication Bypass Fortinet Forticlientems

9.8

CVSS 3.1 · Vendor: fortinet

Severity by source

Vendor (fortinet) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (fortinet) · only source for this CVE.

CVSS VectorVendor: fortinet

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Apr 06, 2026 - 18:12 cisa

CISA KEV

CIRCL Exploitation Confirmed

Apr 06, 2026 - 18:12 circl

CIRCL KEV

PoC Detected

Apr 06, 2026 - 18:12 vuln.today

Public exploit code

Started Trending

Apr 06, 2026 - 16:01 vuln.today

12.8

EUVD ID Assigned

Apr 04, 2026 - 01:00 euvd

EUVD-2026-18963

Analysis Generated

Apr 04, 2026 - 01:00 vuln.today

CVE Published

Apr 04, 2026 - 00:38 nvd

CRITICAL 9.8

DescriptionCVE.org

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Articles & Coverage 3

bleepingcomputer.com CVE-2026-35616: FortiClient EMS Auth Bypass Exploited to Deploy EKZ Infostealer May 28, 2026 medium.com CVE-2026-35616: FortiClient EMS HTTP Header Trust Boundary Bypass Apr 13, 2026 POC CVE-2026-35616: FortiClient EMS Pre-Auth API Bypass Detection Tool Apr 06, 2026

AnalysisAI

Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execute arbitrary code via crafted network requests. The vulnerability stems from improper access control (CWE-284) and requires no user interaction or privileges (CVSS PR:N). With a CVSS score of 9.1 (Critical) and low attack complexity, this represents a severe exposure for organizations using affected FortiClientEMS versions. The CVSS temporal metrics indicate functional exploit code exists (E:F) with an official fix available (RL:O), making this a high-priority patching target despite no confirmed active exploitation (not present in CISA KEV).

Technical ContextAI

FortiClientEMS is Fortinet's endpoint management system used to centrally manage FortiClient deployments across enterprise environments. The vulnerability is rooted in CWE-284 (Improper Access Control), indicating insufficient enforcement of security boundaries when processing network requests. The affected product CPE (cpe:2.3:a:fortinet:forticlientems) identifies this as an application-level flaw in the management server component. The network attack vector (AV:N) combined with no authentication requirement (PR:N) suggests the vulnerable endpoint is exposed without proper authentication checks, allowing remote attackers to bypass access controls entirely. This class of vulnerability typically involves API endpoints, administrative interfaces, or command handlers that fail to validate caller privileges before executing privileged operations, enabling unauthorized code execution with the permissions of the FortiClientEMS service itself.

RemediationAI

Organizations should immediately upgrade FortiClientEMS to a patched version as specified in the official Fortinet security advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-099. The CVSS temporal metric RL:O indicates an official remediation is available from the vendor. Until patching is complete, network-level mitigations should be implemented including restricting access to FortiClientEMS management interfaces to trusted IP ranges only, deploying intrusion prevention signatures to detect exploitation attempts, and monitoring FortiClientEMS logs for unusual authentication patterns or command execution. Given the authentication bypass nature and network attack vector, firewall rules limiting exposure of the management interface to the public internet provide critical interim protection. Organizations should prioritize this remediation given the functional exploit code availability and critical severity rating.