Fortinet FortiClient EMS Hit by Second Critical Zero-Day in Weeks — 2,000+ Exposed

Fortinet is dealing with back-to-back critical vulnerabilities in its FortiClient Endpoint Management Server — the product businesses use to centrally manage and secure all of their endpoint devices. The most recent, CVE-2026-35616, allows an attacker with no credentials to remotely run arbitrary code on your EMS server. That is a big deal because EMS has the keys to the kingdom: it can push configurations and security policies to every managed endpoint in your environment. Internet security researchers identified over 2,000 FortiClient EMS instances exposed directly to the internet, mostly in the US and Germany. Exploitation was confirmed before Fortinet even published its advisory. CISA added it to the known exploited vulnerabilities list on April 6. Fortinet rushed out an emergency hotfix over a holiday weekend. A full permanent patch comes in FortiClient EMS 7.4.7. If you are on 7.4.5 or 7.4.6 and have not applied the hotfix, do it now. If your EMS server is exposed to the internet without a firewall in front of it, that needs to change regardless of patch status.