Back to today’s briefing

Story perspectives

Fortinet Issues Urgent Patches for Critical FortiClient Vulnerabilities

4/5/2026

38 6 Full Breakdown

Summary

Story summary

Fortinet issued urgent patches for two FortiClient EMS vulnerabilities, CVE-2026-35616 and CVE-2026-21643, which allow unauthenticated code execution.
CVE-2026-35616 is a pre-authentication API access bypass, CVSS 9.1, exploited since March 31, 2026.
Fortinet urges users to install the hotfix for FortiClient EMS versions 7.4.5 and 7.4.6 immediately, reflecting the second serious FortiClient EMS flaw in weeks.

1 of 1

Story summary

Fortinet issued urgent patches for two FortiClient EMS vulnerabilities, CVE-2026-35616 and CVE-2026-21643, which allow unauthenticated code execution.
CVE-2026-35616 is a pre-authentication API access bypass, CVSS 9.1, exploited since March 31, 2026.
Fortinet urges users to install the hotfix for FortiClient EMS versions 7.4.5 and 7.4.6 immediately, reflecting the second serious FortiClient EMS flaw in weeks.