INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Fortinet Releases Emergency Patch After FortiClient EMS Exploit

| 2026-04-07 09:26 CRITICAL HIGH
JSON
Executive Summary AI-generated
The threat actors are targeting organizations with endpoint management infrastructure, exploiting vulnerabilities in FortiClient EMS and other software to push malicious updates and launch attacks into cloud systems. The most recent incidents include a critical improper access control vulnerability (CVE-2026-35616) and an SQL injection flaw (CVE-2026-21643). Customers have been urged to upgrade or disconnect the administrative web interface from the internet, while Fortinet has issued emergency patches for affected products.
Technical Mitigations AI-generated
* Implement a secure patching strategy, such as applying hotfixes or patches for FortiClient EMS products immediately after the vulnerability is discovered. * Monitor endpoint management infrastructure and database logs for signs of unauthorized access or malicious activity, and take swift action to contain and remediate any issues. * Regularly update software and firmware to ensure that all systems are running with the latest security patches and updates. * Implement a robust incident response plan, including procedures for containing and remediating zero-day attacks, and provide training to employees on how to respond in such situations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-21643CVE-2026-21643 CVE-2026-35616CVE-2026-35616
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎2026/03/31
The FortiClient EMS platform was exploited to discover a second critical vulnerability.
organisation the FortiClient EMS
Second Critical Flaw in a Week Defused also discovered another critical vulnerability in the FortiClient EMS platform last week, also being exploited in the wild.
‎2026/04/07
Fortinet released an emergency patch for a critical FortiClient EMS vulnerability, CVE-2026-35616.
infrastructure 9.1
This week, Fortinet released out-of-band patches for a critical FortiClient EMS vulnerability, tracked as CVE-2026-35616 (CVSS 9.1), which is already being exploited in attacks in the wild.
organisation Fortinet
This week, Fortinet released out-of-band patches for a critical FortiClient EMS vulnerability, tracked as CVE-2026-35616 (CVSS 9.1), which is already being exploited in attacks in the wild.
organisation FortiClient EMS
This week, Fortinet released out-of-band patches for a critical FortiClient EMS vulnerability, tracked as CVE-2026-35616 (CVSS 9.1), which is already being exploited in attacks in the wild.
organisation SQL
CVE-2026-21643 is an SQL injection flaw with a CVSS score of 9.8 which could allow unauthenticated attackers to execute unauthorized code via specifically crafted HTTP requests.
organisation CVSS
CVE-2026-21643 is an SQL injection flaw with a CVSS score of 9.8 which could allow unauthenticated attackers to execute unauthorized code via specifically crafted HTTP requests.
infrastructure 7.4.5
For that specific vulnerability, customers were urged to upgrade to version 7.4.5 or later, or at least disconnect the administrative web interface from the internet.
organisation FortiClient Enterprise Management
Fortinet customers have been urged to update their FortiClient Enterprise Management Server (EMS) products after the vendor was forced to issue an emergency patch over the weekend.
organisation EMS
Fortinet customers have been urged to update their FortiClient Enterprise Management Server (EMS) products after the vendor was forced to issue an emergency patch over the weekend.
organisation FortiClient EMS 7.4.5
“Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,” the vendor said .
“Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6” Fortinet confirmed active exploitation of the flaw and urges users of FortiClient EMS 7.4.5 and 7.4.6 to install available hotfixes.
organisation API
“The vulnerability allows an unauthenticated attacker to bypass API authentication and authorization entirely, unauthorized code or commands via crafted requests,” Defused said in a social media post.
The flaw is an improper access control issue that allows attackers to bypass authentication through an API and escalate privileges, posing a serious risk to affected systems.
organisation Endpoint
Endpoint management solutions are a popular target for threat actors given the access they provide to company device fleets.
infrastructure 7.4.7
A permanent fix will also be included in version 7.4.7.
organisation Defused
Fortinet acknowledged Simo Kohonen from Defused and Nguyen Duc Anh for responsibly disclosing this vulnerability after observing active zero-day exploitation of the issue.
‎April 9, 2026
Fortinet released an emergency patch for its FortiClient EMS software after the vulnerability was exploited by threat actors.
Tactical Metrics
Metrics
infrastructure
‎7.4.5
Software Version
For that specific vulnerability, customers were urged to upgrade to version 7.4.5 or later, or at least disconnect the administrative web interface from the internet.
Metrics
infrastructure
‎9.1
Software Version
This week, Fortinet released out-of-band patches for a critical FortiClient EMS vulnerability, tracked as CVE-2026-35616 (CVSS 9.1), which is already being exploited in attacks in the wild.
Metrics
infrastructure
‎7.4.7
Software Version
A permanent fix will also be included in version 7.4.7.
Intelligence Sources
Infosecurity-Magazine 2026-04-07
Security Affairs 2026-04-07