DaystoPatch

FortinetExploited incident

FortiClient EMS API authentication and authorization bypass (zero-day)

CVE-2026-35616Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 6 Apr 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fixUnverified source
Follow-through
same day
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2026-35616 (CNA: Fortinet)CuratedQuote verified

    "assignerShortName":"fortinet","dateReserved":"2026-04-03T23:49:34.986Z","datePublished":"2026-04-04T00:38:35.828Z"

    Fortinet's disclosure (already stating in-the-wild exploitation) is the earliest dated public signal found. watchTowr later said honeypot exploitation attempts began 2026-03-31, and Defused posted on X that it saw zero-day exploitation 'earlier this week'; the X post's time could not be fetched.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:937c52a2c57b93c7…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Fortinet advisory FG-IR-26-099ClaimedQuote verified4 Apr 2026

    API authentication and authorization bypass

    The vendor's own disclosure.

    Source
    Fortinet advisory FG-IR-26-099 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a3c1db8c40c90f35…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet PSIRT FG-IR-26-099 (Wayback snapshot 2026-04-04 06:22 UTC)CuratedQuote verified4 Apr 2026

    Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e91cf56726260b47…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-35616ClaimedQuote verified4 Apr 2026, 00:38 UTC

    A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:937c52a2c57b93c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet4 Apr 2026, 01:30 UTC

    unauthenticated attackers run code. Patch now to avoid system compromise! Fix available from Fortinet: https://radar.offseq.com/threat/cve-2026-35616-escalation-of-privilege-in-fortinet-1f903372 #OffSeq #Fortinet #SecurityAlert

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-35616)ClaimedQuote verified6 Apr 2026

    Fortinet FortiClient EMS Improper Access Control Vulnerability

    Added to CISA's KEV catalog on 2026-04-06.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet7 Apr 2026, 11:00 UTC

    📢 CVE-2026-35616 : faille critique FortiClient EMS exploitée activement en zero-day 📝 ## 🗓️ Contexte Source : BleepingComputer — publié le 5 avril 2026. 📖 cyberveille : https://

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2026-35616 (CNA: Fortinet)CuratedQuote verified

    "datePublished":"2026-04-04T00:38:35.828Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:937c52a2c57b93c7…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-26-099CuratedQuote not checked yet4 Apr 2026

    2026-04-04: Initial publication

    Source
    Fortinet PSIRT FG-IR-26-099 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Fortinet docs: FortiClient EMS 7.4.6 release notes change logCuratedQuote not checked yet

    2026-04-03 Added FortiClient EMS 7.4.6 GA hotfix 1.

    Release-note change log (audit 2, T1): the 7.4.6 hotfix was added on 2026-04-03, the US-time day before the advisory's UTC date (CVE record 2026-04-04T00:38Z). FortiClient EMS 7.4.7, the full fix, followed: '2026-04-07 Initial release.' (7.4.7 release notes).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-26-099 (Wayback snapshot 2026-04-04 06:22 UTC)CuratedQuote verified4 Apr 2026

    In the meantime the hotfix above is sufficient to prevent it entirely.

    Hotfixes for both affected versions (7.4.5 and 7.4.6) were published with the advisory; the full release 7.4.7 was 'upcoming'. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e91cf56726260b47…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Fortinet docs: FortiClient EMS 7.4.5 release notes change logCuratedQuote not checked yet

    2026-04-03 Added FortiClient EMS 7.4.5 GA hotfix 1.

    Both affected versions (7.4.5 and 7.4.6) had a hotfix on 2026-04-03.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-26-099 (Wayback snapshot 2026-04-04 06:22 UTC)CuratedQuote verified4 Apr 2026

    Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6

    Only 7.4.5 and 7.4.6 are affected and both had a hotfix on the disclosure day. The 7.4.7 release date was not evidenced (the live advisory still calls it 'Upcoming' in its summary while the table says 'Upgrade to 7.4.7 or above').

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e91cf56726260b47…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

This advisory changed after publication

  1. FG-IR-26-099

    Changed without a revision note

    API authentication and authorization bypass

    Version table: 1 row added and 1 row removed. One new row reads "FortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to 7.4.7 or above".

    • Fixed versions
    Version table rows
    BeforeFortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to upcoming 7.4.7 or above
    AfterFortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to 7.4.7 or above
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    MS 7.4.7 will also include a fix for this issue. In the meantime the hotfix above is sufficient to prevent it entirely. Version | Affected | Solution FortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to upcoming 7.4.7 or above FortiClientEMS 7.2 | Not affected | Not Applicable Fortinet remediated this issue in FortiClient Cloud and hence customers do not need to perform any action. Fortinet remed

    After

    MS 7.4.7 will also include a fix for this issue. In the meantime the hotfix above is sufficient to prevent it entirely. Version | Affected | Solution FortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to 7.4.7 or above FortiClientEMS 7.2 | Not affected | Not Applicable Fortinet remediated this issue in FortiClient Cloud and hence customers do not need to perform any action. Fortinet remediated thi

    Earlier version captured 8 Apr 2026, 09:23 UTC: archived copyLater version captured 17 May 2026, 20:56 UTC: archived copyRecovered from archived copiesSnapshots ddd99ae9c2… and af6309f232…Incident page

Send this to your boss

FortiClient EMS zero-day lets attackers run code without login; hotfix Apr 3

Attackers exploited a FortiClient EMS API bypass before Fortinet issued out-of-band hotfixes on 3 April 2026 (advisory on 4 April UTC).

In plain words

Fortinet's endpoint management server (FortiClient EMS) had a flaw that let outsiders run commands on it without logging in, and attackers were using it before a fix existed. Fortinet released an emergency hotfix on 3 April 2026 and the full fixed version 7.4.7 on 7 April. If we run EMS 7.4.5 or 7.4.6, we need the hotfix or a newer version, and we should check the server for signs of a break-in.

What happened and who is affected

What happened

On 4 April 2026 Fortinet disclosed CVE-2026-35616, an improper access control flaw in the FortiClient EMS API that lets an unauthenticated attacker bypass authentication and run code, and said it had been exploited in the wild. Hotfixes for the two affected versions, 7.4.5 and 7.4.6, are dated 3 April 2026 in Fortinet's release notes, and the full fix, 7.4.7, followed on 7 April. watchTowr reported exploitation attempts against its honeypots from 31 March 2026.

Who is affected

On-premises FortiClient EMS 7.4.5 and 7.4.6. EMS 8.0 and 7.2 are not affected; FortiClient Cloud and FortiSASE were fixed by Fortinet.

CVE-2026-35616. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/fortinet-cve-2026-35616/

Affected products

  • FortiClient EMS
How we built this timeline

Zero-day disclosed by the vendor on 4 Apr 2026 (Easter weekend) with hotfixes; credited to Simo Kohonen (Defused) and Nguyen Duc Anh. The Hacker News (5 Apr 2026) reports watchTowr honeypot attempts from 31 Mar 2026 and a Defused post on X about zero-day exploitation 'earlier this week'; neither was a dated public report before the advisory that could be fetched, so world uses the advisory.

KEV 6 Apr 2026. Fixes were hotfixes on top of 7.4.5/7.4.6, counted as patches.

Fortinet CVSSv3 9.8. R3 search (23 Oct 2026): no public Defused post predating the advisory could be found.

Defused's X post cannot be fetched; Mastodon hashtag timelines (#fortinet, #FortiClient on mastodon.social) show EMS exploitation posts on 30 Mar 2026/31, but those concern CVE-2026-21643 (Defused via Security Affairs, 30 Mar 2026), not this bug; the first CVE-2026-35616 post found is 4 Apr 2026, after the 00:38Z CVE record.

World therefore stays at the advisory; unresolved. T1 check (23 Oct 2026, audit 2): the EMS release-note change logs date both hotfixes to 3 Apr 2026 and 7.4.7 to 7 Apr 2026;

First fix/Fixed for all versions moved from 4 Apr 2026 to 3 Apr 2026. exploited before a fix stays true: watchTowr recorded exploitation attempts from 31 Mar 2026 (The Hacker News, 5 Apr 2026), before the first fix.

Related

Fortinet report card