CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerability
Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Overview
FortiClient EMS versions 7.4.5 and 7.4.6 contain an improper access control flaw that allows a remote, unauthenticated attacker to execute arbitrary code or commands on the EMS server by sending crafted network requests. No credentials or user interaction are required. Because FortiClient EMS manages endpoint security policies across an organization, a successful attack gives an adversary a foothold in a central management plane with full confidentiality, integrity, and availability impact on the server.
Vulnerability details
CWE-284 (Improper Access Control) describes a failure to enforce trust boundaries around protected functionality. In FortiClient EMS 7.4.5 and 7.4.6, certain network-accessible functionality does not enforce authentication or authorization checks before acting on incoming requests. The application accepts and processes those requests from untrusted parties as if they were authorized, bypassing the access control layer that should gate privileged operations. The specific endpoint or protocol path involved has not been publicly disclosed by Fortinet.
An attacker with network access to the EMS management interface sends crafted requests requiring no credentials and no user interaction. The server processes these requests and executes unauthorized code or commands. Because FortiClient EMS is a centralized endpoint management platform, code execution on it carries high impact across confidentiality, integrity, and availability. The attack requires only that the EMS server be reachable over the network and running an affected version; no prior foothold or account is needed.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor the EMS server for unexpected process creation or child processes spawned from the EMS service process, particularly shells or scripting interpreters, which would indicate command execution via the access control bypass.
- Review EMS server host-based logs for process execution under the EMS service account that does not correspond to a known update, backup, or administrative action, and treat unexplained entries as potential signs of prior exploitation.
Remediation
Additional hardening
- Upgrade FortiClientEMS to a version beyond 7.4.6; the affected range is 7.4.5 through 7.4.6 and no fixed version boundary is specified in the available data, so consult the vendor advisory listed in References for the confirmed fixed release.
- Restrict network access to the EMS management interface using firewall rules or ACLs so that only known FortiClient agent subnets and administrator workstations can reach it, removing the unauthenticated remote attack surface entirely.
- Place the EMS server on an isolated management network segment and require VPN or jump-host access for administrators, preventing opportunistic scanning from reaching the service.
- Forward EMS server host and application logs to a central log store so that process-execution and authentication events are retained off-host and available for investigation.
Key dates
References
Frequently asked questions
Does CVE-2026-35616 affect my FedRAMP authorization?
If Fortinet FortiClient EMS runs inside your authorization boundary, yes. CVE-2026-35616 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of April 9, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-35616?
Knox does not patch your software. Remediating Fortinet FortiClient EMS is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, alongside continuous compliance monitoring and audit-artifact coverage that help you document the fix ahead of your next assessment. The remediation work is yours to carry out; maintaining compliance posture while you do it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a case like CVE-2026-35616, exposure surfaces during continuous monitoring rather than waiting until an assessor flags it at a scheduled review, giving you earlier visibility and more time to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-35616's remediation deadline of April 9, 2026 has passed. What happens now?
If CVE-2026-35616 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing the finding out now and documenting why the deadline was missed is what keeps your authorization intact and your agency relationship on solid ground.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
