ctrlINT What the industry said about every indicator, with the quote

CVE-2026-35616Vulnerability

Fortinet FortiClient EMS Improper Access Control Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 4 independent sources · first reported by Recorded Future · last reported

Last reported yesterday

CISA KEVAdded 6 Apr 2026
Fix due 9 Apr 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS94.0%
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

5 reports, newest first · the exact sentence from each

  1. “CVE-2026-35616 (Fortinet FortiClient authentication bypass) (Actively exploited)”

    The Hacker NewsNews
    Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

  2. “Edge devices exploited at scale (per operator records): FortiClient EMS (CVE-2026-35616, 2,236 targets, 108 created admins, 4,140 managed endpoints), SimpleHelp (CVE-2024-57727, 242 unique IP addresses impacted) and cPanel (CVE-2026-41940, 49+ claimed breaches)”

    SOCRadarVendor
    INC and The Gentlemen Ransomware: Exposed AI Infrastructure

  3. “…on Vulnerabilties and Exposures (CVEs), Fortinet released an update for an Improper Access Control vulnerability in FortiClient EMS (CVE-2026-35616), while CISA reported active exploitation of a Microsoft SharePoint spoofing vulnerability CVE-2026-32201.”

    CERT-EUGovernment
    Cyber Brief 26-05 - April 2026

  4. “Threat actors exploited CVE-2026-35616 in FortiClient EMS to distribute an infostealer disguised as a legitimate Fortinet patch.”

    CERT-EUGovernment
    Cyber Brief 26-06 - May 2026

  5. “Insikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA.”

    Recorded FutureVendor
    June 2026 CVE Landscape

Indicators reported together

named in the same reports
Copy this indicator · defanged

Also named with it: CVE-2026-33825, CVE-2025-55182, CVE-2024-57727, CVE-2026-41940, CVE-2026-42208, CVE-2025-49113, CVE-2026-15409, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-43284, CVE-2026-0300, CVE-2026-45585, CVE-2026-32201, CVE-2025-59528, CVE-2026-21509, CVE-2025-8088

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-35616 here?
No account needed. We do not store your IP address.