TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

NetSPI

CVE-2026-35616 & CVE-2026-21643 – Fortinet FortiClientEMS: Overview & Takeaways

Brock Kjelden · 2026-04-07 · Read original ↗

ATT&CK techniques detected

3 predictions
T1190Exploit Public-Facing Application
99%
"cve - 2026 - 35616 & cve - 2026 - 21643 – fortinet forticlientems : overview & takeaways fortinet has disclosed two critical vulnerabilities in forticlient endpoint management server ( ems ) that are both under active exploitation in the wild. cve - 2026 - 35616 is an improper ac…"
T1190Exploit Public-Facing Application
94%
"##ntems 7. 4. 6 release notes cve - 2026 - 35616 — permanent fix : included in the upcoming forticlientems 7. 4. 7 release. cve - 2026 - 21643 : upgrade from forticlientems 7. 4. 4 to version 7. 4. 5 immediately. mitigation ( if patching is delayed ) restrict network access to th…"
T1190Exploit Public-Facing Application
60%
"issuing a detection for cve - 2026 - 21643, which will present as : sql injection – fortinet forticlientcms ( cve - 2026 - 21643 ) netspi ’ s penetration testing services can also help identify exposure to these vulnerabilities. additional resources nvd — cve - 2026 - 35616 : htt…"

Summary

Fortinet has disclosed two critical vulnerabilities in FortiClient Endpoint Management Server (EMS) that are both under active exploitation in the wild. 

The post CVE-2026-35616 & CVE-2026-21643 – Fortinet FortiClientEMS: Overview & Takeaways appeared first on NetSPI.