CVE-2026-35616 — Fortinet FortiClient EMS Improper Access Control Vulnerability

CVE-2026-35616

CRITICAL · CVSS 9.8 ⚠ KEV — EXPLOITED

EPSS exploitation probability: 100%

⚠ Listed in the CISA Known Exploited Vulnerabilities catalog — actively exploited.

Published 2026-04-06 · Last modified 2026-07-24T21:10:00.143

Summary

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Affected products

Fortinet — FortiClient EMS

Does this affect you?

Add your gear to cvedb and we'll alert you only when Fortinet ships something exploited.

Check my exposure →

References

NVD entry
CVE.org record

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.