CVE-2026-35616

CVE-2026-35616 is an improper access control vulnerability (CWE-284) affecting Fortinet FortiClientEMS versions 7.4.5 through 7.4.6. It enables an unauthenticated attacker to execute unauthorized code or commands by sending crafted requests to the vulnerable component. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact across confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to execute arbitrary code or commands on the affected FortiClientEMS server, potentially leading to full system compromise, data theft, or further lateral movement within the network.

Fortinet's advisory (FG-IR-26-099) and the CISA Known Exploited Vulnerabilities Catalog entry provide guidance on mitigation, including applying vendor patches and implementing network controls to restrict access to the EMS management interface. Security practitioners should review these resources for specific patch versions and workarounds.

This vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.