MSRXVulnerabilities / CVE-2026-35616
CVE-2026-35616
Published 2026-04-04 · published (not yet in NVD)
CVE-2026-35616
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-06, with a fix-by date of 2026-04-09. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
9.1 CRITICAL
CVSS 3.1 · CNA
CVSS 3.1 · CNA
94%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Affected products
- Fortinet FortiClientEMS: 7.4.5 to ≤ 7.4.6
Weakness: CWE-284
1 references (advisories, patches, write-ups)
Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.