Fortinet urgently released a security patch over the weekend to address a newly identified, actively exploited, high-severity vulnerability in FortiClient Enterprise Management Server (EMS).

Designated as CVE-2026-35616, the bug involves inadequate access controls, potentially allowing remote, unauthorized individuals to run malicious code or commands through manipulated requests.

A patch was issued on Saturday, with Fortinet confirming active real-world exploitation of the flaw.

“Fortinet has seen evidence of real-world exploit attempts and strongly advises affected users to apply the patch for FortiClient EMS versions 7.4.5 and 7.4.6,” according to Fortinet’s warning.

Fortinet clarifies that versions 7.4.5 and 7.4.6 of FortiClient EMS are affected and that installing specific hotfixes will resolve the vulnerability:

• https://docs.fortinet.com/document/forticlient/7.4.5/ems-release-notes/832484 – for FortiClientEMS 7.4.5
• https://docs.fortinet.com/document/forticlient/7.4.6/ems-release-notes/832484 – for FortiClientEMS 7.4.6

The upcoming FortiClientEMS 7.4.7 will also contain a fix. Version 7.2 of FortiClient EMS remains unaffected.

Cybersecurity company Defused discovered the vulnerability, describing it as a flaw that allowed attackers to completely bypass authentication measures.

Defused stated on X that they witnessed zero-day exploits of this vulnerability earlier in the week before reporting it responsibly to Fortinet.

Internet security monitor Shadowserver has identified over 2,000 exposed FortiClient EMS instances online, mostly in the United States and Germany.

This vulnerability is the second critical FortiClient EMS issue in recent weeks. CVE-2026-21643, reported last week, is also being exploited.

Defused also discovered the previous vulnerability. Fortinet credited Nguyen Duc Anh for the most recent one.

Fortinet urges immediate application of the provided hotfixes or upgrading to version 7.4.7 (when available) to reduce the risk of system compromise.