Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<div>
<div>
<div><p><strong>Number:</strong> AL26-007<br /><strong>Date:</strong> April 7, 2026</p>
Audience
This Alert is intended for IT professionals and managers.
Purpose
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
Details
The Cyber Centre is aware of a critical vulnerability impacting Fortinet FortiClient Endpoint Management Server (EMS)1. In response to the vendor advisory released on April 4, 2026, the Cyber Centre released AV26-313 on April 7, 2026Footnote 2.
Tracked as CVE-2026-35616Footnote 3, this vulnerability is an improper access control vulnerability (CWE-284)Footnote 4 in Fortinet FortiClientEMS 7.4.5 through 7.4.6 that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Fortinet FortiClientEMS is a centralized security management solution for Fortinet's endpoint agents (FortiClient). It enables administrators to manage, deploy, and monitor security policies, Zero Trust Network Access (ZTNA) tags, and vulnerability scanning for Windows, macOS, and mobile endpoints, primarily designed for enterprise security.
Further information about the impacted versions of Fortinet instances can be found in the Fortinet advisoryFootnote 1.
This vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalogFootnote 5 on April 6, 2026.
Suggested actions
The Cyber Centre recommends that organizations using Fortinet FortiClientEMS, review the Fortinet security bulletinFootnote 1 and update or upgrade the affected instances to the following versions:
| Affected product | Affected version | Solution |
|---|---|---|
| FortiClientEMS 7.4 | 7.4.5 | Install hotfixFootnote 6 or upgrade to upcoming 7.4.7 or above |
| FortiClientEMS 7.4 | 7.4.6 | Install hotfixFootnote 7 or upgrade to upcoming 7.4.7 or above |
| FortiClientEMS 7.2 | Not affected | Not affected |
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topicsFootnote 8.
- Patch operating systems and applications
- Harden operating systems and applications
- Isolate web-facing applications
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email [email protected].
References
- Footnote 1
-
API authentication and authorization bypass
<p><a rel="noreferrer" target="_blank">Return to footnote1 referrer</a></p> </dd> <dt>Footnote 2</dt> <dd> <p><a rel="noreferrer" target="_blank">AV26-313 – Fortinet security advisory</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote2 referrer</a></p> </dd> <dt>Footnote 3</dt> <dd> <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-35616" rel="noreferrer" target="_blank">CVE-2026-35616 Detail</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote3 referrer</a></p> </dd> <dt>Footnote 4</dt> <dd> <p><a href="https://cwe.mitre.org/data/definitions/284" rel="noreferrer" target="_blank">CWE-284: Improper Access Control</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote4 referrer</a></p> </dd> <dt>Footnote 5</dt> <dd> <p><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35616" rel="noreferrer" target="_blank">CISA KEV: CVE-2026-35616</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote5 referrer</a></p> </dd> <dt>Footnote 6</dt> <dd> <p><a href="https://docs.fortinet.com/document/forticlient/7.4.5/ems-release-notes/832484" rel="noreferrer" target="_blank">Installing an EMS hotfix | FortiClient 7.4.5 | Fortinet Document Library</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote6 referrer</a></p> </dd> <dt>Footnote 7</dt> <dd> <p><a href="https://docs.fortinet.com/document/forticlient/7.4.6/ems-release-notes/832484" rel="noreferrer" target="_blank">Installing an EMS hotfix | FortiClient 7.4.6 | Fortinet Document Library</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote7 referrer</a></p> </dd> <dt>Footnote 8</dt> <dd> <p><a rel="noreferrer" target="_blank">Top 10 IT security actions to protect Internet connected networks and information (ITSM.10.089)</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote8 referrer</a></p> </dd>
</div>
Article Link: AL26-007 - Vulnerability impacting Fortinet FortiClientEMS - CVE-2026-35616 - Canadian Centre for Cyber Security