CVE-2026-35616: listed in the CISA KEV catalog CVE-2026-35616 · CVSS 9.8 CRITICAL · EPSS 89% · KEV 2026-04-06
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Is CVE-2026-35616 exploited? Listed in the CISA KEV catalog on 2026-04-06. Federal remediation due 2026-04-09. Past that date by 128 days. EPSS puts exploitation in the next 30 days at 89%. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2026-35616 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-11.
CVE-2026-35616: listed in the CISA KEV catalog CVE-2026-35616 · CVSS 9.8 CRITICAL · EPSS 89% · KEV 2026-04-06
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Is CVE-2026-35616 exploited? Listed in the CISA KEV catalog on 2026-04-06. Federal remediation due 2026-04-09. Past that date by 128 days. EPSS puts exploitation in the next 30 days at 89%. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2026-35616 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-11.