CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerability

EPSS trend

Probability

9.10%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

-81.65 pp

From 90.75% on 19-09-2026

19-09-202619-10-2026

EPSS score

9.10%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 06-04-2026
Federal due date: 09-04-2026

CIRCLListed

Added: 06-04-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2026-35616

Public exploits

0 found

No public exploits indexed.

References

2 links

fortiguard.fortinet.com/psirt/FG-IR-26-099PatchVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616Government ResourceUS Government Resource

Related vulnerabilities

CVE-2021-44172fortinetforticlient_endpoint_management_server+10.85%3y ago13-09-2023 12:30An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path.CVE-2025-59922fortinetforticlientems7.76%9mo ago13-01-2026 16:32An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.CVE-2025-22855fortinetforticlientems0.36%1y ago08-04-2025 14:02An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code.CVE-2025-22859fortinetforticlientems+10.60%1y ago13-05-2025 14:46A Relative Path Traversal vulnerability [CWE-23] in FortiClientEMS 7.4.0 through 7.4.1 and FortiClientEMS Cloud 7.4.0 through 7.4.1 may allow a remote unauthenticated attacker to perform a limited arbitrary file write on the system via upload requests.CVE-2020-9287fortinetforticlient_emergency_management_server+10.42%6y ago15-03-2020 21:56A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable CVE-2024-21753fortinetforticlient_endpoint_management_server+10.74%2y ago10-09-2024 14:37A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests

All vulnerabilities inforticlientems

CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References