{"id":45143,"date":"2026-04-06T03:13:21","date_gmt":"2026-04-05T19:13:21","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/06\/new-forticlient-ems-flaw-exploited-in-attacks-emergency-patch-released\/"},"modified":"2026-04-06T03:13:21","modified_gmt":"2026-04-05T19:13:21","slug":"new-forticlient-ems-flaw-exploited-in-attacks-emergency-patch-released","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/06\/new-forticlient-ems-flaw-exploited-in-attacks-emergency-patch-released\/","title":{"rendered":"New FortiClient EMS flaw exploited in attacks, emergency patch released"},"content":{"rendered":"\n<p style=\"text-align:center\"><img loading=\"lazy\" decoding=\"async\" height=\"900\" src=\"https:\/\/www.bleepstatic.com\/content\/hl-images\/2023\/03\/13\/Fortinet.jpg\" width=\"1600\" alt=\"New FortiClient EMS flaw exploited in attacks, emergency patch released\"><\/p>\n<p>Fortinet has released an emergency weekend security update for a new critical FortiClient Enterprise Management Server (EMS) vulnerability that is actively exploited in attacks.<\/p>\n<p>Tracked as CVE-2026-35616, the flaw is an improper access control vulnerability that allows unauthenticated attackers to execute code or commands via specially crafted requests.<\/p>\n<p>The issue was patched Saturday, with Fortinet confirming it has been exploited in the wild.<\/p>\n<p>&#8220;Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,&#8221; <a href=\"https:\/\/fortiguard.fortinet.com\/psirt\/FG-IR-26-099\" target=\"_blank\" rel=\"nofollow noopener\">warns Fortinet<\/a>.<\/p>\n<p>Fortinet says the vulnerability impacts FortiClient EMS versions 7.4.5 and 7.4.6 and can be mitigated by installing one of the following hotfixes:<\/p>\n<ul style=\"list-style-type:square\">\n<li><a href=\"https:\/\/docs.fortinet.com\/document\/forticlient\/7.4.5\/ems-release-notes\/832484\" target=\"_blank\" rel=\"nofollow noopener\">https:\/\/docs.fortinet.com\/document\/forticlient\/7.4.5\/ems-release-notes\/832484<\/a> &#8211; for FortiClientEMS 7.4.5<\/li>\n<li><a href=\"https:\/\/docs.fortinet.com\/document\/forticlient\/7.4.6\/ems-release-notes\/832484\" target=\"_blank\" rel=\"nofollow noopener\">https:\/\/docs.fortinet.com\/document\/forticlient\/7.4.6\/ems-release-notes\/832484<\/a> &#8211; for FortiClientEMS 7.4.6<\/li>\n<\/ul>\n<p>The vulnerability will also be fixed in the upcoming&nbsp;FortiClientEMS 7.4.7.&nbsp;FortiClient EMS 7.2 is not affected.<\/p>\n<p>The flaw was discovered by cybersecurity firm Defused, which described it as a pre-authentication API access bypass&nbsp;that allows attackers to bypass authentication and authorization controls entirely.<\/p>\n<p>Defused <a href=\"https:\/\/x.com\/DefusedCyber\/status\/2040315969159995847\" target=\"_blank\" rel=\"nofollow noopener\">shared on X<\/a> that they observed the flaw being exploited as a zero-day earlier this week before reporting it to Fortinet under responsible disclosure.<\/p>\n<p>Internet security watchdog <a href=\"https:\/\/x.com\/Shadowserver\/status\/2040845567882928304\" target=\"_blank\" rel=\"nofollow noopener\">Shadowserver<\/a> has found over 2,000 exposed FortiClient EMS instances online, with the majority located in the USA and Germany.<\/p>\n<p>The vulnerability follows a separate critical FortiClient EMS flaw, <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/critical-fortinet-forticlient-ems-flaw-now-exploited-in-attacks\/\" target=\"_blank\" rel=\"nofollow noopener\">CVE-2026-21643<\/a>, reported last week and also actively exploited in attacks.<\/p>\n<p>Both vulnerabilities were discovered by Defused, with Fortinet also crediting Nguyen Duc Anh for the latest flaw.<\/p>\n<p>Fortinet is urging customers to apply the hotfixes immediately or upgrade to version 7.4.7 when it becomes available to mitigate the risk of compromise.<\/p>\n<style> .ia_ad {     background-color: #f0f6ff;     width: 95%;     max-width: 800px;     margin: 15px auto;     border-radius: 8px;     border: 1px solid #d6ddee;     display: flex;     align-items: stretch;     padding: 0;     overflow: hidden; }  .ia_lef {     flex: 1;     max-width: 200px;     height: auto;     display: flex;     align-items: stretch; }  .ia_lef a {     display: flex;     width: 100%;     height: 100%; }   .ia_lef a img {     width: 100%;     height: 100%;          border-radius: 8px 0 0 8px;     margin: 0;     display: block; }  .ia_rig {     flex: 2;     padding: 10px;     display: flex;     flex-direction: column;     justify-content: center; }  .ia_rig h2 {     font-size: 17px !important;     font-weight: 700;     color: #333;     line-height: 1.4;     font-family: Georgia, \"Times New Roman\", Times, serif;     margin: 0 0 14px 0; }  .ia_rig p {     font-weight: bold;     font-size: 14px;     margin: 0 0 clamp(6px, 2vw, 14px) 0; }  .ia_button {     background-color: #FFF;     border: 1px solid #3b59aa;     color: black;     text-align: center;     text-decoration: none;     border-radius: 8px;     display: inline-block;     font-size: 16px;     font-weight: bold;     cursor: pointer;     padding: 10px 20px;     width: fit-content; }  .ia_button a {     text-decoration: none;     color: inherit;     display: block; }  @media (max-width: 600px) {     .ia_ad {         flex-direction: column;         align-items: center;     }      .ia_lef {         max-width: 100%;     }      .ia_lef a img {         border-radius: 8px 8px 0 0;     }       .ia_rig {         padding: 15px;         width: 100%;     }      .ia_button {         width: 100%; \tmargin: 0px auto;     } } <\/style>\n<div>\n<div>         <a href=\"https:\/\/hubs.li\/Q048zztN0\" target=\"_blank\" rel=\"noopener sponsored\">             <img decoding=\"async\" src=\"https:\/\/www.bleepstatic.com\/c\/p\/picus-whitepaper.jpg\" alt=\"New FortiClient EMS flaw exploited in attacks, emergency patch released\">         <\/a>     <\/div>\n<div>\n<h2><a href=\"https:\/\/hubs.li\/Q048zztN0\" target=\"_blank\" rel=\"noopener sponsored\">Automated Pentesting Covers Only 1 of 6 Surfaces.<\/a><\/h2>\n<p>Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.<\/p>\n<p>This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.<\/p>\n<p>           <button><a href=\"https:\/\/hubs.li\/Q048zztN0\" target=\"_blank\" rel=\"noopener sponsored\">Get Your Copy Now<\/a><\/button>     <\/div>\n<\/p><\/div>\n<div>\n<h3>Related Articles:<\/h3>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/critical-fortinet-forticlient-ems-flaw-now-exploited-in-attacks\/\">Critical Fortinet Forticlient EMS flaw now exploited in attacks<\/a><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/critical-citrix-netscaler-memory-flaw-actively-exploited-in-attacks\/\">Critical Citrix NetScaler memory flaw actively exploited in attacks<\/a><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/cisa-new-langflow-flaw-actively-exploited-to-hijack-ai-workflows\/\">CISA: New Langflow flaw actively exploited to hijack AI workflows<\/a><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/cisa-orders-feds-to-patch-max-severity-cisco-flaw-by-sunday\/\">CISA orders feds to patch max-severity Cisco flaw by Sunday<\/a><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/wordpress-membership-plugin-bug-exploited-to-create-admin-accounts\/\">WordPress membership plugin bug exploited to create admin accounts<\/a><\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Fortinet has released an emergency weekend security upd [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28],"tags":[],"class_list":["post-45143","post","type-post","status-publish","format-standard","hentry","category--bleepingcomputer"],"_links":{"self":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts\/45143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/comments?post=45143"}],"version-history":[{"count":0,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts\/45143\/revisions"}],"wp:attachment":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/media?parent=45143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/categories?post=45143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/tags?post=45143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}