InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to protect FortiClient Enterprise Management Server (EMS) systems from a known security issue by Friday. Tracked as CVE-2026-35616, this security flaw was found by the cybersecurity company Defused.
Fortinet shared urgent fixes over the weekend to fix the problem. They said the security issue comes from a weak access control that allows unauthorized attackers to run code or commands using special requests.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The company also warned that threat actors had been exploiting it in zero-day attacks and warned IT administrators to secure their EMS instances as soon as possible by applying the hotfixes or upgrading to FortiClient EMS version 7.4.7 when it becomes available.
“Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,” the company said.
Shadowserver is tracking about 2,000 FortiClient EMS systems online. More than 1,400 of these are in the United States and Europe. But it is unclear how many have been fixed or still have problems.
On Monday, CISA put CVE-2026-35616 on its list of Known Exploited Vulnerabilities (KEV) and told Federal Civilian Executive Branch (FCEB) agencies to fix FortiClient EMS by Thursday midnight, April 9, as required by Binding Operational Directive (BOD) 22-01.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency warned.
“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
Even though BOD 22-01 is meant for U.S. federal agencies, CISA encouraged everyone, including private companies, to focus on fixing CVE-2026-35616 and to secure their networks quickly.
Fortinet fixed another serious FortiClient EMS problem (CVE-2026-21643) in February. This issue was noted just under two weeks ago as being used in attacks.
