Fortinet Rushes Emergency Fixes for Exploited Zero-Day

The improper access control bug in FortiClient EMS allows unauthenticated attackers to execute arbitrary code remotely.

Fortinet over the weekend rushed emergency fixes for a FortiClient Enterprise Management Server (EMS) vulnerability that has been exploited as a zero-day.

Described as an improper access control issue, the critical-severity flaw is tracked as CVE-2026-35616 (CVSS score of 9.1) and could be exploited for remote code execution (RCE).

According to Fortinet’s advisory, remote attackers could send crafted requests to a vulnerable FortiClient EMS to trigger the bug. Successful exploitation does not require authentication, it says.

“Fortinet has observed this to be exploited in the wild,” the company warned.

On Saturday, Fortinet announced the availability of hotfixes to address the security defect in FortiClient EMS versions 7.4.5 and 7.4.6, noting that version 7.2 is not affected.

The company also published detailed instructions on how to download and ...