2,000+ FortiClient EMS Instances Exposed Online Amid Active RCE Vulnerability Exploits in the Wild

Shadowserver warns that approximately 2,000 FortiClient EMS instances are publicly exposed and that two unauthenticated RCE vulnerabilities — CVE-2026-35616 (new) and CVE-2026-21643 — are confirmed exploited in the wild; a compromised EMS could allow attackers to execute arbitrary code, manipulate endpoint configurations, harvest VPN credentials, and maintain persistent access. Organizations are advised to apply Fortinet patches immediately, restrict internet-facing EMS access, review logs for anomalous activity, monitor Shadowserver’s dashboard, and enable SIEM/EDR alerts.