CVE-2026-35616 Security Incident affecting FortiClient EMS

Evidence indicates that FortiClient EMS is affected by a security issue. Exploitation evidence is classified as confirmed in the wild.

What Happened

Evidence indicates that FortiClient EMS is affected by a security issue. Exploitation evidence is classified as confirmed in the wild.

Why This Matters

Current evidence identifies a security issue involving FortiClient EMS, but does not yet support a more specific impact claim.

Recommended Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Confirm whether FortiClient EMS is present in your environment and review the affected configuration.

Exposure

Exploitation status: CONFIRMED_IN_THE_WILD

Primary entities:

Authoritative Intelligence

Provider evidence: NVD, CISA KEV, FIRST EPSS

EPSS is a vulnerability exploitation probability signal, not proof that your environment is exposed. CISA KEV means known exploitation of the vulnerability, not that your system was exploited.

Timeline

• Incident first seen
  Apr 03, 2026 05:30

  BugSkan first recorded this incident.

• New infosec products of the month: March 2026 - Help Net Security
  Apr 03, 2026 05:30

  helpnetsecurity.com · Vulnerability

Sources

Watchlist Match