CVE-2026-35616: Critical FortiClient EMS Flaws – DACH IT Alert
Cybersecurity monitor with Code-Stream. The Fortinet vulnerabilities in FortiClient EMS are hitting DACH IT teams at a time when patch frequency is already at its limit. (Photo: T. Miroshnichenko / Pexels)
Fortinet has patched two critical vulnerabilities in FortiClient EMS within three weeks. CVE-2026-35616, with a CVSS score of 9.1, allows for Pre-Authenticated Remote Code Execution – Honeypot data from Shadowserver shows active exploit attempts since March 31, 2026. The pattern indicates: FortiClient EMS is structurally exposed, and patch frequency alone is no longer sufficient as a sole measure.
Key Takeaways
- Two critical patches in three weeks. CVE-2026-35616 (CVSS 9.1, Pre-Auth RCE) and a subsequent advisory on a privilege escalation vector in FortiClient EMS – this is not a one-off event, but a pattern.
- CISA KEV inclusion on April 2, 2026. Federal agencies in the USA have a 7-day patch deadline. DACH IT teams without similar governance must set their own deadline.
- Exploit pattern active since March 31. Shadowserver and GreyNoise are registering probe traffic against exposed FortiClient EMS installations. Those running EMS without network segmentation are directly exposed.
- Patching alone is not enough. JDBC injection as an attack vector in FortiClient EMS means: unauthenticated users can execute SQL queries. Network access control on the EMS port is a critical immediate measure.
Related: Source-Code Breaches: When Attackers Know the Security Vendor Before the Patch
What is FortiClient EMS? FortiClient EMS (Endpoint Management Server) is Fortinet’s central management platform for the FortiClient agent on endpoints. EMS controls compliance policies, VPN configurations, and security posture assessments for all managed endpoints in the network – making it a highly privileged target for attackers.
RelatedSource-Code Breaches: When the Security Vendor is Compromised Before the Patch / CVE-2026-3854: GitHub Enterprise RCE – 88% unpatched
What sets CVE-2026-35616 apart from previous FortiClient vulnerabilities
FortiClient EMS has a documented history of vulnerabilities. CVE-2023-48788 was an SQL injection flaw with a CVSS score of 9.8, which was massively exploited in 2024 and added to the CISA KEV list. The pattern repeats: JDBC-based injection, pre-auth access, critical CVSS score.
CVE-2026-35616 targets the same attack vector as its predecessor – JDBC database access without prior authentication. According to Fortinet’s advisory on March 29, 2026, an unauthenticated attacker can execute SQL code on the EMS database via manipulated HTTP requests. The direct result: system access to the EMS server with database rights.
What sets this incident apart from the 2023 predecessor: the time from patch release to honeypot activity was shorter this time. Shadowserver registered the first exploit attempts against CVE-2026-35616 on March 31, 2026 – two days after the advisory. For CVE-2023-48788, it took around two weeks before the first mass exploitation.
Key figures on the threat situation
CVSS 9.1
Critical score for CVE-2026-35616, Pre-Auth RCE via JDBC Injection
2 Days
from advisory to first honeypot exploit attempts (Shadowserver)
7 Days
Mandatory patch for US federal agencies after CISA KEV inclusion on April 2, 2026
Why FortiClient EMS is structurally exposed
FortiClient EMS is inherently a high-privilege system. It knows all managed endpoints, their compliance status, VPN connections, and security policies. If an attacker compromises EMS, they not only gain access to a server – they obtain a map of the entire endpoint inventory and levers to manipulate security policies.
The real issue is the deployment practice: many DACH companies operate FortiClient EMS without strict network segmentation – with direct access from the internal network or, worse, from DMZ segments. However, EMS is a management system that should never be directly accessible from the user LAN.
“Every other FortiClient EMS deployment we see during penetration tests has the management port directly accessible from the internal network. This is a design flaw, not a configuration error.”
– Alec Chizhik, securitytoday.de
The Patch and Hardening Checklist for DACH Teams
Check patch status first – but patching alone won’t solve the structural problem. A combined measures list:
- Immediate Action: Check EMS version. Affected are FortiClient EMS versions 7.4.0 to 7.4.1 and 7.2.0 to 7.2.7. The fix is included in 7.4.2 and 7.2.8. Version check: diagnose sys version in the EMS-CLI.
- Restrict network access. EMS port 443 should be accessible exclusively from a dedicated management segment – not from the general user LAN. Check and adjust firewall rules if necessary.
- Exposure check: Is EMS accessible from the internet? Query Shodan or FOFA for your own external IP. Publicly accessible EMS instances are an immediate priority.
- Log review for exploit attempts. Fortinet’s IOC list for CVE-2026-35616 contains specific HTTP request patterns. SIEM search for these patterns in the last 30 days.
- Plan a two-patch cadence. Fortinet released two critical advisories in three weeks. Teams running EMS should define a dedicated patch track with a max. 72h reaction time for Fortinet criticals.
Completed After Patching
- RCE vector CVE-2026-35616 closed
- Privilege escalation patch (Advisory 2) applied
- Fortinet support status for version confirmed
- Patch documentation created for audit trail
Structurally Still Open
- Network segmentation for EMS port not yet implemented?
- Log review for exploit attempts before patch date
- Incident response plan for compromised EMS instance missing
- No dedicated patch SLA defined for Fortinet criticals
What This Pattern Means for DACH IT Teams
Fortinet is not an isolated case. Check Point, Palo Alto, Ivanti, SonicWall – all major security vendors have published critical vulnerabilities in their management platforms in the last 18 months that have been actively exploited. The pattern is consistent: management software as a target.
The strategic consequence: Security management software must be treated with the same hardening standards as privileged Active Directory components. This means: Management ports not accessible from the user LAN, dedicated patch track, daily log monitoring for anomalies.
Teams that have not yet implemented these basic principles for all their security management platforms should use the current Fortinet CVE wave as a trigger for a management surface hardening project – not as a one-time patch event.
Sources: Fortinet PSIRT Advisory CVE-2026-35616 (March 29, 2026) | CISA KEV (April 2, 2026) | Shadowserver Foundation Exploit Telemetry
Frequently Asked Questions
Every question is locked. A tap unlocks the answer.
Which FortiClient EMS versions are affected by CVE-2026-35616?
Affected are FortiClient EMS 7.4.0 to 7.4.1 and 7.2.0 to 7.2.7. The patched versions are 7.4.2 (fixes 7.4.x branch) and 7.2.8 (fixes 7.2.x branch). Older versions should be brought to the current minor branch according to Fortinet’s upgrade path documentation.
How can I tell if my EMS instance has already been compromised?
Fortinet’s PSIRT advisory contains specific Indicators of Compromise (IOC). Search the EMS web server log for unusual HTTP POST requests to database access paths. Additionally, new local administrator accounts or unknown scheduled tasks on the EMS host indicate post-exploitation activity.
Do I need to disable EMS until the patch is applied?
If EMS is not accessible from the Internet and access is restricted to a dedicated management segment, temporary disabling is not mandatory – network isolation significantly reduces the risk. For EMS with Internet access: immediately set up a firewall block and apply the patch as soon as possible.
Does the CISA patch deadline also apply to European companies?
No, the CISA KEV patch deadline of 7 days only applies to US federal agencies. However, it is a useful benchmark: if US federal agencies consider 7 days reasonable, this should be a maximum for DACH companies with a similar compliance level, not a guideline.
What if we use FortiClient EMS as a cloud service?
Fortinet’s cloud-managed variant (FortiCloud EMS) is patched by Fortinet. Check if the instance is actually cloud-managed – many companies operate “cloud” as a self-managed VM in their own cloud environment. In this case, all self-managed patching responsibilities apply.
Network
Alec Chizhik writes for SecurityToday about vulnerability analyses, exploit telemetry, and operational security decisions for DACH IT teams
Title image source: Pexels / Tima Miroshnichenko
