CVE-2026-35616

Critical9.8 Published on Apr 4, 2026

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Apr 6, 2026
US federal agencies must remediate it by Apr 9, 2026 (BOD 22-01)
Attacked on the day of disclosure
Used in ransomware campaigns

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Oct 20, 2026 Jul 27, 2026 Jun 25, 2026 Jun 21, 2026 Jun 11, 2026 May 27, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-284

Vendorsfortinet