U.S. CISA adds a flaw in Fortinet FortiClient EMS to its Known Exploited Vulnerabilities catalog

CISA added Fortinet FortiClient EMS vulnerability CVE-2026-35616 (CVSS 9.1) to its Known Exploited Vulnerabilities catalog after Fortinet confirmed active in-the-wild exploitation; the flaw is an improper access control issue allowing unauthenticated API requests to bypass authentication and escalate privileges. Fortinet released out-of-band hotfixes for EMS 7.4.5 and 7.4.6, plans a permanent fix in 7.4.7, and CISA ordered federal agencies to remediate by April 9, 2026; observers recommend patching and monitoring for indicators such as X-SSL-CLIENT-VERIFY:SUCCESS from unknown IPs.