CVE-2026-35616 & CVE-2026-21643 – Fortinet FortiClientEMS: Overview & Takeaways
Fortinet has disclosed two critical vulnerabilities in FortiClient Endpoint Management Server (EMS) that are both under active exploitation in the wild. CVE-2026-35616 is an improper access control flaw (CWE-284) that allows an unauthenticated attacker to bypass API authentication and execute unauthorized code or commands via crafted requests. CVE-2026-21643 is a SQL injection vulnerability (CWE-89) exploitable by remote, unauthenticated attackers via specially crafted HTTP requests. Both vulnerabilities warrant immediate action given confirmed in-the-wild exploitation and the central role FortiClientEMS plays in enterprise endpoint management.
What do I need to know?
CVE-2026-35616 — Improper Access Control / API Authentication Bypass
| Vulnerability | CVE-2026-35616 |
| Severity | 9.1 (Critical) – CVSS v3.1, per vendor advisory; NVD score pending |
| Attack Vector | Network – unauthenticated, no user interaction required |
| Impacted Products | • Fortinet FortiClientEMS 7.4.5 • Fortinet FortiClientEMS 7.4.6 |
| Potential Impact | • Unauthenticated remote code execution on the EMS server • Privilege escalation and unauthorized command execution • Lateral movement across managed endpoints via policy manipulation |
CVE-2026-21643 — SQL Injection
| Vulnerability | CVE-2026-21643 |
| Severity | 9.1 (Critical) – CVSS v3.1, per vendor advisory; NVD score pending |
| Attack Vector | Network – unauthenticated, via HTTP requests |
| Impacted Products | • Fortinet FortiClientEMS 7.4.4 (multi-tenant mode deployments only) • FortiClientEMS 7.2.x and 8.0.x branches are NOT affected |
| Potential Impact | • Unauthenticated remote code execution via SQL injection • Unauthorized database command execution |
What do I need to do?
We recommend the following steps to identify and remediate these vulnerabilities:
Review and Audit
- Identify all instances of FortiClientEMS in your environment and confirm the installed version.
- CVE-2026-35616: Flag any deployments running versions 7.4.5 or 7.4.6 without the applied hotfix.
- CVE-2026-21643: Flag any deployments running version 7.4.4, particularly those with multi-tenant mode enabled. Single-site deployments are not affected.
- Review EMS server logs for anomalous API requests or unexpected command execution activity indicative of exploitation.
- Fortinet has not published indicators of compromise; detection currently relies on log review and configuration auditing.
Patch Immediately
- CVE-2026-35616 — FortiClientEMS 7.4.5: Apply the out-of-band hotfix: FortiClientEMS 7.4.5 Release Notes
- CVE-2026-35616 — FortiClientEMS 7.4.6: Apply the out-of-band hotfix: FortiClientEMS 7.4.6 Release Notes
- CVE-2026-35616 — Permanent fix: Included in the upcoming FortiClientEMS 7.4.7 release.
- CVE-2026-21643: Upgrade from FortiClientEMS 7.4.4 to version 7.4.5 immediately.
Mitigation (If Patching Is Delayed)
- Restrict network access to the FortiClientEMS administrative interface to trusted IP ranges only; do not expose it directly to the internet.
- Implement web application firewall rules to block anomalous HTTP header injection patterns (relevant to CVE-2026-21643).
- Monitor EMS server processes for unexpected child process spawning (e.g., cmd.exe, powershell.exe) as a potential indicator of CVE-2026-35616 exploitation.
- Treat any internet-exposed FortiClientEMS instance as potentially compromised pending patch application, given confirmed in-the-wild exploitation of both vulnerabilities.
NetSPI Product and Services Coverage
NetSPI’s External Attack Surface Management is issuing a detection for CVE-2026-21643, which will present as: SQL Injection – Fortinet FortiClientCMS (CVE-2026-21643)
NetSPI’s Penetration Testing Services can also help identify exposure to these vulnerabilities.
Additional Resources
- NVD — CVE-2026-35616: https://nvd.nist.gov/vuln/detail/CVE-2026-35616
- NVD — CVE-2026-21643: https://nvd.nist.gov/vuln/detail/CVE-2026-21643
- MITRE — CVE-2026-35616: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35616
- MITRE — CVE-2026-21643: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21643
- Fortinet Hotfix — FortiClientEMS 7.4.5: Release Notes
- Fortinet Hotfix — FortiClientEMS 7.4.6: Release Notes
Authors:
Explore More Blog Posts
I’m Just Asking Questions: Social Engineering as a Reporter
Dive into this real-world social engineering assessment where a fake anonymous tip and an adversary-in-the-middle framework tested the limits of an organization's security policies.
Beyond the Hype: What Regulated Industries Need to Know Before Trusting AI Security Tooling
AI security tools can build an attack, but enterprise security teams in regulated industries need consistency, auditability, and predictable costs before they can trust one. Learn why the surrounding infrastructure is where most AI security vendors are still falling short.
Splunk Enterprise Unauthenticated Arbitrary File Operations/RCE (CVE-2026-20253): Overview and Takeaways
Splunk disclosed CVE-2026-20253 on June 10, 2026, affecting Splunk Enterprise versions in the 10.0.x and 10.2.x branches. The flaw stems from a PostgreSQL sidecar service endpoint that completely lacks authentication controls (CWE-306), allowing any network-reachable attacker to invoke arbitrary file creation or truncation operations without credentials.