CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerability
Published Apr 4, 2026
·Updated
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Other sources
Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
— CISA
Affected Software
3 affected components
Fortinet FortiClient EMS
Fortinet FortiClientEMS=7.4.5
Fortinet FortiClientEMS=7.4.6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiClientEMSto a version that resolves this vulnerability.Fixed in 7.4.7 - Upgrade
Upgrade
Fortinet FortiClientEMSto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Apr 4, 2026
CVE Published
via MITRE·12:38 AM
Data Sourced
via MITRE·12:38 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Apr 5, 2026
News Published
via BleepingComputer·06:45 PM
News Published
via BleepingComputer·06:46 PM
Apr 6, 2026
Known Exploited
via CISA·12:00 AM
Data Sourced
via CISA·12:00 AM
RemedyDescriptionAffected Software
News Published
via BleepingComputer·04:02 PM
News Published
via The Register·06:14 PM
News Published
via The Register·06:17 PM
Apr 15, 2026
News Published
via The Register·05:52 PM
Apr 17, 2026
News Published
via BleepingComputer·09:30 AM
May 12, 2026
News Published
via BleepingComputer·06:23 PM
May 28, 2026
News Published
via BleepingComputer·05:25 PM
Jun 10, 2026
News Published
via BleepingComputer·03:00 PM