New Fortinet Flaw Allows Unauthorized Access to Enterprise Systems

Fortinet disclosed a critical zero-day in FortiClient EMS (CVE-2026-35616, CVSS 9.1) that enables pre-authentication API access bypass and potential privilege escalation; active exploitation was observed prior to public disclosure, prompting Fortinet to release emergency hotfixes and guidance to restrict EMS exposure, monitor logs, and harden access controls.