InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to protect FortiClient Enterprise Management Server (EMS) systems from a known security issue by Friday. Tracked as CVE-2026-35616, this security flaw was found by the cybersecurity company Defused.
Fortinet shared urgent fixes over the weekend to fix the problem. They said the security issue comes from a weak access control that allows unauthorized attackers to run code or commands using special requests.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
The company also warned that threat actors had been exploiting it in zero-day attacks and warned IT administrators to secure their EMS instances as soon as possible by applying the hotfixes or upgrading to FortiClient EMS version 7.4.7 when it becomes available.
“Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,” the company said.
Shadowserver is tracking about 2,000 FortiClient EMS systems online. More than 1,400 of these are in the United States and Europe. But it is unclear how many have been fixed or still have problems.
On Monday, CISA put CVE-2026-35616 on its list of Known Exploited Vulnerabilities (KEV) and told Federal Civilian Executive Branch (FCEB) agencies to fix FortiClient EMS by Thursday midnight, April 9, as required by Binding Operational Directive (BOD) 22-01.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency warned.
“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
Even though BOD 22-01 is meant for U.S. federal agencies, CISA encouraged everyone, including private companies, to focus on fixing CVE-2026-35616 and to secure their networks quickly.
Fortinet fixed another serious FortiClient EMS problem (CVE-2026-21643) in February. This issue was noted just under two weeks ago as being used in attacks.
