{"id":202305,"date":"2026-04-05T00:32:00","date_gmt":"2026-04-05T04:32:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/04\/05\/fortinet-patches-actively-exploited-cve-2026-35616-in-forticlient-ems\/"},"modified":"2026-04-05T01:35:15","modified_gmt":"2026-04-05T05:35:15","slug":"fortinet-patches-actively-exploited-cve-2026-35616-in-forticlient-ems","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/04\/05\/fortinet-patches-actively-exploited-cve-2026-35616-in-forticlient-ems\/","title":{"rendered":"Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS"},"content":{"rendered":"

Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/04\/fortinet-patches-actively-exploited-cve.html<\/a><\/p>\n

Publish Date: 2026-04-05 00:32:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points.
\n\ue804Ravie Lakshmanan\ue802Apr 05, 2026Vulnerability \/ API Security
\nFortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the\u00a0wild.
\nThe\u00a0vulnerability, tracked\u00a0as CVE-2026-35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading to privilege escalation.
\n“An improper access control vulnerability [CWE-284] in FortiClient EMS may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests,”\u00a0Fortinet said in a Saturday\u00a0advisory.
\nThe\u00a0issue affects FortiClient EMS versions 7.4.5\u00a0through 7.4.6. It’s expected to be fully patched in the upcoming version 7.4.7, although the company\u00a0has released a\u00a0hotfix to address\u00a0it.\u00a0<\/p>\n

Simo\u00a0Kohonen from Defused Cyber and Nguyen Duc Anh have been credited with discovering and reporting the flaw. In\u00a0a post on X, Defused\u00a0Cyber said it observed zero-day exploitation of CVE-2026-35616 earlier this week. According to watchTowr, exploitation attempts against CVE-2026-35616 were first recorded against its honeypots on March 31,\u00a02026.
\nSuccessful exploitation of the flaw could allow an unauthenticated attacker to sidestep API authentication and authorization protections, and execute malicious code or commands via crafted\u00a0requests.\u00a0
\n“Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5\u00a0and 7.4.6,” the company\u00a0added.
\nThe\u00a0development comes merely days after\u00a0another recently-patched, critical vulnerability in FortiClient EMS\u00a0(CVE-2026-21643, CVSS score: 9.1) came under active exploitation. It’s currently not known if the same threat actor is behind the exploitation of both the flaws, and if they are being weaponized\u00a0together.
\nGiven\u00a0the severity of the vulnerabilities, users are advised to update their FortiClient EMS to the latest version as soon as\u00a0possible.
\n“The timing of the ramp-up of in-the-wild exploitation of this zero-day is likely not coincidental,” watchTowr CEO and founder Benjamin Harris told The Hacker\u00a0News.<\/p>\n

“Attackers have shown repeatedly that holiday weekends are the best time to move. Security teams are at half strength, on-call engineers are distracted, and the window between compromise and detection stretches from hours to days. Easter, like any other holiday, represents opportunity.”
\n“What is disappointing is the bigger picture. This\u00a0is the second unauthenticated vulnerability in FortiClient EMS in a matter of\u00a0weeks.”
\n“So, once again, organizations running FortiClient EMS and exposed to the Internet should treat this as an emergency response situation, not something to pick up on Tuesday morning. Apply\u00a0the hotfix. Attackers already have a head\u00a0start.”<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS https:\/\/thehackernews.com\/2026\/04\/fortinet-patches-actively-exploited-cve.html Publish Date: 2026-04-05 00:32:00 Source Domain:…<\/p>\n","protected":false},"author":1,"featured_media":202306,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh61_DDvLhdLZ8tHMrmQ8XlQ1vWwnEk-2lmYFnjw_1ZvJ4IUB4G7ffXU8pSd7JDknP0bqyaVVOTb1HJ62ujlQ_zfG3Lc7XMtLKUuZTO6v4jgrdqon90wrix6EaQNKtou3yz7Txf3ni5JOVn-D1-OcHB7e-UDxQI2ifZOBHAeDwFBnwAfanSeFn8EyP8oilj\/s16000\/fortinet.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[35,34,27],"class_list":["post-202305","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-hacker","tag-threat-actor","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/202305"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=202305"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/202305\/revisions"}],"predecessor-version":[{"id":202307,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/202305\/revisions\/202307"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/202306"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=202305"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=202305"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=202305"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}