Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS

Sunday, April 5, 2026 at 04:32 AM UTC·Source: The Hacker News

Updated: Monday, April 6, 2026 at 12:17 AM UTC

Executive Summary

Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading to privilege escalation. "An improper access control vulnerability [CWE-284] in FortiClient EMS may allow an

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-35616

NVD MITRE CVE

Source Attribution

Originally published by The Hacker News on Apr 5, 2026.

Related Threats

MEDIUMVulnerability

The End of Static Security: Why AI Demands Real-Time Microsegmentation

AI is compressing cyberattack timelines from months to minutes. While segmentation has been a gold standard security practice for years, many organizations are still operating with outdated, static approaches.

2h agoBank Info Security

MEDIUMVulnerability

Why Data Security Standards in Cancer Innovation Matter

Cancer research and treatment innovation - and the tech that powers that - requires a great deal of collaboration and data sharing among multiple parties. But keeping that sensitive information secure and private is crucial - and requires adherence to standards, said Baxter Lee of Clearwater.

2h agoBank Info Security

MEDIUMVulnerability

One-Time Passcodes Are Gateway for Financial Fraud Attacks

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/one-time-passcodes-are-gateway-for-financial-fraud-attacks-image_small-6-a-31341.jpg" align=right hspace=4><b>Report Reveals Growing Trend of Fraudsters Intercepting SMS-Based Verification</b><br>Financial institutions have historically relied on one-time passcodes as a primary authentication control for their accountholders. But

2h agoBank Info Security