FortiClientEMS Vulnerability CVE-2026-35616 Actively Exploited
Summary
CERT-FR issued advisory CERTFR-2026-AVI-0400 warning of active exploitation of CVE-2026-35616 in Fortinet FortiClientEMS. The vulnerability allows remote code execution, privilege escalation, and security policy bypass on affected versions 7.4.x through 7.4.5. Organizations running vulnerable FortiClientEMS deployments are urged to apply patches immediately.
What changed
CERT-FR published a critical security advisory regarding CVE-2026-35616, a vulnerability in Fortinet FortiClientEMS that is actively exploited in the wild. The vulnerability enables unauthenticated attackers to achieve remote code execution, privilege escalation, and bypass security policies on vulnerable installations. Affected systems running FortiClientEMS 7.4.x through 7.4.5 without the latest patches are at immediate risk.
Organizations using Fortinet endpoint management software should prioritize applying the vendor-provided security updates immediately. If immediate patching is not feasible, network isolation and enhanced monitoring for exploitation attempts are recommended as interim measures. The French cybersecurity authority's advisory underscores the active threat landscape targeting this vulnerability.
What to do next
- Apply security patches from Fortinet bulletin FG-IR-26-099 (patch to version 7.4.6 or later)
- Isolate affected systems from network if patching cannot be performed immediately
- Monitor for indicators of compromise related to CVE-2026-35616 exploitation
Archived snapshot
Apr 8, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Premier Ministre S.G.D.S.N
Agence nationale
de la sécurité des
systèmes d'information
Paris, le 07 avril 2026 N° CERTFR-2026-AVI-0400 Affaire suivie par: CERT-FR
Avis du CERT-FR
Objet: Vulnérabilité dans Fortinet FortiClientEMS
Gestion du document
| Référence | CERTFR-2026-AVI-0400 |
| Titre | Vulnérabilité dans Fortinet FortiClientEMS |
| Date de la première version | 07 avril 2026 |
| Date de la dernière version | 07 avril 2026 |
| Source(s) | Bulletin de sécurité Fortinet FG-IR-26-099 du 04 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.
Risques
- Contournement de la politique de sécurité
- Exécution de code arbitraire à distance
- Élévation de privilèges
Systèmes affectés
- FortiClientEMS versions 7.4.x postérieures ou égales à 7.4.5 sans les derniers correctifs de sécurité
Résumé
Une vulnérabilité a été découverte dans Fortinet FortiClientEMS. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la politique de sécurité.
Fortinet indique que la vulnérabilité CVE-2026-35616 est activement exploitée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Documentation
- Bulletin de sécurité Fortinet FG-IR-26-099 du 04 avril 2026
- https://www.fortiguard.com/psirt/FG-IR-26-099
- Référence CVE CVE-2026-35616
- https://www.cve.org/CVERecord?id=CVE-2026-35616
Gestion détaillée du document
- le 07 avril 2026 Version initiale
Related changes
Get daily alerts for CERT-FR Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from ANSSI.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-FR Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.