A serious vulnerability has been reported in Fortinet FortiClient EMS, identified as CVE-2026-35616. With a CVSS score of 9.8, the issue is rated very severe and is currently in the stage of active exploitation. That combination means organizations should treat this as an urgent patching priority.
Even though there is currently no public proof-of-concept (PoC) or working exploit referenced that demonstrates misuse, the expectation is that such code may appear soon. When that happens, the risk of more scanning activity and larger-scale compromise can increase quickly.
What is FortiClient EMS and why this matters
FortiClient EMS is security management software used by organizations to administer and protect endpoints such as laptops and mobile devices. In practical terms, it helps teams enforce security controls across devices so systems remain protected against cyberattacks.
This vulnerability matters because it affects the security controls that are supposed to prevent unauthorized actions. If those controls can be bypassed, attackers can potentially move from having an initial foothold to taking meaningful control over systems inside an organization.
Details of the vulnerability: CVE-2026-35616
The vulnerability is designated as CVE-2026-35616. According to the alert, it can be used to bypass security checks remotely without needing login credentials. That is a critical detail: many defenses assume authentication is required, and this scenario undermines that assumption.
The alert also indicates that active exploitation is already known. That means the threat is not hypothetical; it is already being used in the wild to target affected environments.
Potential impact if systems are not patched
If an attacker can exploit FortiClient EMS CVE-2026-35616, they may be able to execute unauthorized code or commands. In the worst case, that could allow an attacker to gain full control over a system, and then use that control to cause real damage.
Depending on how your environment is set up, the consequences may include:
- Loss of confidential information through data theft or unauthorized access
- Disruption of business operations caused by manipulation or interruption of systems
- Reputational harm when incidents lead to public exposure
Because the vulnerability is severe and is being exploited, these outcomes are not merely theoretical.
Is there a public PoC or exploit available?
At the time of the alert, there is no publicly available proof-of-concept (PoC) code or known exploit published that explains the misuse. However, the alert highlights an important expectation: in the near term, a PoC may become available.
When that happens, attackers may increase activity. More PoC availability often leads to more automation, which can increase the volume of scanning and the likelihood of large-scale exploitation. In other words, patching sooner helps reduce the window in which attackers can probe and compromise targets.
Immediate recommendation: install the security update
Fortinet has released an update that resolves the vulnerability. The core guidance is straightforward: install the available security update as soon as possible. If exploitation is already occurring against similar targets, delays can increase the chance that your organization is next.
For many organizations, “install the update” also means checking whether the update has been applied successfully across all relevant systems and not just on a single server or one test machine.
How to confirm whether you use FortiClient EMS
If you are unsure whether your organization uses FortiClient EMS, do not guess. Instead, verify through your environment inventory and management records.
Practical next steps include contacting your IT service provider or internal IT team to help you confirm whether FortiClient EMS is in use and whether it is affected. The same team can also support the update process and perform checks to ensure systems are properly secured afterward.
What to ask your IT provider during patching
When you contact your IT partner, it helps to request a clear plan rather than only “please patch.” Consider asking for the following:
- Where FortiClient EMS is installed (and which versions are currently running)
- When the security update will be applied and how long the change window will be
- How the update will be verified after installation
- Whether additional checks are performed to confirm that exploitable conditions are removed
Having these points documented makes it easier to demonstrate that your organization responded appropriately to an actively exploited vulnerability.
Why fast action matters even without a public PoC
It is easy to think, “If there is no PoC yet, the risk is lower.” In this case, that reasoning does not hold. The alert clearly states that the vulnerability is already being exploited, and that a PoC may only make things worse by accelerating adoption and automation by attackers.
So the focus should be on reducing exposure now. Patching and verification are the most direct ways to lower the chance of successful intrusion.
Next steps for organizations
To respond effectively to FortiClient EMS CVE-2026-35616, follow a simple sequence:
- Act quickly: schedule the installation of the vendor security update immediately.
- Verify usage: confirm whether your environment contains FortiClient EMS.
- Validate the result: ensure the update is applied and that relevant systems are checked after patching.
- Document the response: keep records of what was changed and when, including verification steps.
When a vulnerability is rated very severe and exploitation is already underway, a structured response is essential.
Conclusion
The reported vulnerability CVE-2026-35616 in Fortinet FortiClient EMS is serious: it carries a CVSS score of 9.8 and is already known to be under active exploitation. With remote bypass of security controls and no login credentials required, the risk of system takeover and harm to your organization is real.
Install the available security update as quickly as possible, and if you are unsure whether FortiClient EMS is present in your environment, involve your IT provider to confirm usage and complete patching and post-update checks.
Source: https://www.ncsc.nl/alerts/kwetsbaarheid-in-forticlient-ems-van-fortinet
