CISA Warns of Fortinet 0-Day Vulnerability Actively Exploited in Attacks

CISA added CVE-2026-35616 to its KEV catalog after active exploitation was observed of a critical pre-authentication API access bypass in Fortinet FortiClient EMS (affecting 7.4.5 and 7.4.6) that can lead to unauthenticated remote code execution; Fortinet issued an emergency advisory and hotfix, Shadowserver found more than 2,000 publicly accessible EMS instances with confirmed exploitation, and U.S. federal agencies were given a three-day remediation deadline.