CVE-2026-35616

Severity

high · on CISA KEV actively exploited

Source

CISA-KEV · kev

Published

2026-04-06

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-35616

⚡ RCE ⌖ exploited in the wild shame 85/100 rceexploited-in-wildunpatched

Fortinet FortiClient EMS allows unauthenticated attackers to execute arbitrary code via crafted requests.

This unauthenticated RCE in FortiClient EMS enables remote code execution without authentication, posing a severe risk to DIB environments relying on endpoint management tools. Organizations must immediately patch and audit access controls to prevent unauthorized code execution and potential data exfiltration.

Shame score — An unauthenticated RCE in a critical endpoint management product is a high-impact, avoidable failure that directly undermines DIB security posture.

Players implicated

Fortinet · vendor FortiClient EMS · product

Description

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Affected FedRAMP products 0 in the catalog

No correlated FedRAMP products.