CVE-2026-35616: FortiClient EMS API Auth Bypass Enables Command Execution

Fortinet disclosed CVE-2026-35616, a critical (CVSS 9.1) pre-authentication API auth/authorization bypass in FortiClient EMS (affecting 7.4.5–7.4.6) that can allow unauthenticated execution of commands; vendor-observed in-the-wild exploitation and an out-of-band hotfix were issued—organizations should apply the hotfix, restrict internet access to EMS, and review logs/back to late March 2026.