CISA Alerts Defenders to Actively Exploited Fortinet Zero-Day Vulnerability

**CISA urgent warning:** CISA added CVE-2026-35616 — a critical, unauthenticated access-control bypass in Fortinet FortiClient Enterprise Management Server (EMS) that enables remote code execution — to its Known Exploited Vulnerabilities catalog on April 6, 2026; active exploitation has been observed, and organizations (including FCEB agencies) must apply vendor mitigations or discontinue EMS by the April 9, 2026 remediation deadline.