CRITICAL Alert: FortiClient EMS Systems Under Relentless Cyberattack
The cybersecurity landscape is currently facing a severe threat as The Shadowserver Foundation has issued an urgent warning regarding FortiClient Enterprise Management Server (EMS) instances. Over 2,000 publicly accessible FortiClient EMS instances have been identified globally, with two already confirmed to be actively exploited through critical unauthenticated remote code execution (RCE) vulnerabilities. This situation demands immediate attention from all FortiClient EMS administrators.
Two specific vulnerabilities, CVE-2026-35616 and CVE-2026-21643, are at the heart of these active exploits. Both are classified as unauthenticated RCE flaws and have been leveraged in the wild against Fortinet’s FortiClient EMS platform. While CVE-2026-35616 is a newly disclosed vulnerability, CVE-2026-21643 has been under recent scrutiny. The critical update is that both are now unequivocally confirmed as exploited in the wild, meaning threat actors are actively gaining unauthorized access to unpatched deployments without requiring any credentials.
Understanding Unauthenticated RCE: A Looming Threat
Unauthenticated RCE vulnerabilities represent one of the most severe classes of security flaws. They empower attackers to remotely execute arbitrary code on a vulnerable server without the need for a username or password. This level of access can lead to complete control over the compromised system and, more alarmingly, all the endpoints it manages. For an enterprise solution like FortiClient EMS, this translates into profound implications for an organization’s entire network security posture.
Global Exposure: Over 2,000 FortiClient EMS Instances Vulnerable
Shadowserver’s extensive global sensor network has identified approximately 2,000 FortiClient EMS instances exposed to the public internet. Analysis of their public dashboard data reveals that the United States and Germany currently report the highest numbers of affected servers. Given that FortiClient EMS serves as a critical enterprise endpoint management solution, centralizing the control of Fortinet VPN clients and security policies across vast corporate networks, this widespread exposure carries significant, far-reaching implications.
A compromised FortiClient EMS server can open the floodgates for attackers, enabling them to:
- Manipulate endpoint configurations.
- Push malicious policy updates to all managed devices.
- Harvest sensitive VPN credentials.
- Establish persistent footholds across an organization’s entire endpoint fleet.
Escalating Threat: Fortinet a Persistent Target
This latest cybersecurity alert aligns with a broader, concerning trend of threat actors specifically targeting Fortinet infrastructure. Fortinet products have frequently appeared in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Historically, both sophisticated nation-state groups and aggressive ransomware operators have prioritized exploiting Fortinet flaws as a prime method for initial access into enterprise environments. The current active exploitation of FortiClient EMS vulnerabilities reinforces this pattern, making rapid response paramount.
Immediate Action Required: FortiClient EMS Mitigation Steps
Organizations leveraging FortiClient EMS must take decisive and immediate action to protect their networks. The following steps are critical for mitigation:
- Apply Patches Immediately: Implement all security patches released by Fortinet that address CVE-2026-35616 and CVE-2026-21643 without any delay. This is the most crucial step.
- Restrict Internet Access: Severely limit internet-facing access to the FortiClient EMS management interface. Implement stringent firewall rules or mandate VPN-gated access to ensure only authorized personnel from trusted networks can reach it.
- Review Logs Thoroughly: Proactively review system logs for any anomalous activity, unauthorized configuration changes, or unexpected outbound connections that could indicate a compromise.
- Monitor Exposure Intelligence: Keep a close watch on Shadowserver’s dashboard for ongoing exposure intelligence pertinent to your network ranges and FortiClient EMS deployments.
- Enable Threat Detection Alerts: Configure your SIEM (Security Information and Event Management) or EDR (Endpoint Detection and Response) platform to generate high-priority alerts for indicators associated with these specific CVEs.
Fortinet has officially urged all customers to consult its security advisories and upgrade to patched firmware versions without hesitation. Given the confirmed in-the-wild exploitation of these critical vulnerabilities affecting FortiClient EMS, delaying remediation is simply not an option. Act now to safeguard your organization’s digital assets.
