CVE-2026-35616 Fortinet FortiClientEMS
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
- CVSS
- 9.1 Critical
- EPSS
- 94%
- Percentile
- 100
- Published
- 2026-04-04
- Force
- 10 of 12
- Public PoC
- 8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
On CISA’s exploited list
Fortinet FortiClient EMS Improper Access Control Vulnerability
- Added
- 2026-04-06
- Federal patch deadline
- 2026-04-09
- Ransomware use
- not known