The U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated that federal agencies protect their FortiClient Enterprise Management Server (EMS) systems against a vulnerability being actively used by attackers by the end of the work week.

Designated CVE-2026-35616, this flaw was identified by the security company Defused. They described it as an issue that lets attackers bypass security checks even before logging in, giving them unauthorized access.

Fortinet quickly released patches over the weekend to fix the problem, explaining that it involves incorrect access controls. This allows unverified attackers to run code or commands by sending specific, malicious requests.

The company also cautioned that malicious actors were already exploiting this vulnerability without any prior warning (zero-day attacks). They urged IT staff to quickly secure their EMS systems by installing the provided hotfixes or upgrading to FortiClient EMS version 7.4.7 when available.

“Fortinet has seen this vulnerability being actively exploited and strongly advises affected customers to install the hotfix for FortiClient EMS versions 7.4.5 and 7.4.6,” the company stated.

The internet security monitoring group Shadowserver currently monitors almost 2,000 exposed FortiClient EMS instances online, with over 1,400 IP addresses located in the United States and Europe. However, it’s unclear how many have been patched or still have vulnerable settings.

​​On Monday, CISA added CVE-2026-35616 to its list of Known Exploited Vulnerabilities (KEV). They then instructed all Federal Civilian Executive Branch (FCEB) agencies to apply the necessary patches to their FortiClient EMS systems by midnight on Thursday, April 9, as required by Binding Operational Directive (BOD) 22-01.

“This kind of vulnerability is commonly used by malicious actors and creates serious risks for the federal government’s IT infrastructure,” the security agency warned.

“Follow the vendor’s instructions to mitigate the issue, adhere to BOD 22-01 guidelines for cloud services, or stop using the product if there are no available solutions.”

While BOD 22-01 is only applicable to U.S. federal agencies, CISA encouraged everyone (including those in the private sector) to prioritize patching CVE-2026-35616 and secure their networks as quickly as possible.

Fortinet previously fixed another major FortiClient EMS vulnerability (CVE-2026-21643) in February, which was also highlighted less than two weeks ago as being exploited in attacks.

Exploits of Fortinet vulnerabilities are common in cyber espionage operations and ransomware attacks (often as zero-day flaws) to gain access to corporate networks. Recently, Fortinet disabled FortiCloud SSO connections from devices running vulnerable firmware versions to address CVE-2026-24858 zero-day exploits.