CyberSIXT Search
Fortinet product

FortiClient EMS

← All Fortinet products

No CISA KEV deadline is open. CISA last added a FortiClient EMS CVE on 13 Apr. Coverage is above its usual rate: 3 articles in 7 days, against a weekly average of 0.0.

Tracked since 9 Feb · latest article Fri 23 Oct · RSS

Added to KEV · 90 days
0
of 3 in the full CISA catalogue · all time
High exploit odds · current
0
EPSS top 5%, not in KEV
Articles · 7 days
3
↑ vs 0.0 a week

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2026-21643FortiClient EMS13 AprDeadline passed 16 Apr12 articles
CVE-2026-35616FortiClient EMS6 AprDeadline passed 9 Apr15 articles
CVE-2023-48788not in CyberSIXT coverageFortiClient EMS25 Mar 2024Deadline passed 15 Apr 2024Known ransomware use

Coverage

24 articles · all timeFull timeline

24 articles from 7 outlets since 9 Feb; 3 in the last 7 days.

FortiClient EMS: coverage over time24 articles from 7 outlets. First report 9 Feb by SecurityOnline. Busiest week: 8 articles, week of 6 Apr. 3 in the last 7 days. FortiClient EMS: coverage over time24 articles from 7 outlets. First report 9 Feb by SecurityOnline. Busiest week: 8 articles, week of 6 Apr. 3 in the last 7 days.
  • Article
  • First report
  • Official notice
Show as table
FortiClient EMS: articles
Published (UTC)OutletHeadline
Fri 23 Oct · 18:36 UTCThe Hacker NewsAI Agents Power Ransomware Affiliates’ Attacks on Edge Devices
Fri 23 Oct · 08:35 UTCSecurityOnlineINC Ransomware Exposed Using AI and Custom Malware Against Victims
Tue 20 Oct · 11:56 UTCSOCRadarAI-Driven Ransomware Campaign Targeted 62 Organisations
Thu 28 May · 16:31 UTCSecurity AffairsFortiClient EMS flaw used to deploy EKZ Infostealer via fake patch
Thu 28 May · 13:00 UTCSecurityWeekFortiClient EMS bug exploited to deliver EKZ Infostealer
Thu 28 May · 06:32 UTCSecurityOnlineFortiClient EMS flaw used to drop EKZ Infostealer via fake updates
Tue 14 Apr · 06:31 UTCThe Hacker NewsCISA adds six KEV flaws amid active Fortinet exploits
Mon 13 Apr · 22:05 UTCCISACISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
Mon 13 Apr · 21:37 UTCCISACISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
Wed 8 Apr · 22:34 UTCSecurity AffairsCISA adds critical Ivanti EPMM flaw to KEV after PoC release
Tue 7 Apr · 00:38 UTCCISACISA Warns of Fortinet FortiClient EMS Flaw Allowing RCE
Mon 6 Apr · 21:11 UTCDark ReadingFortinet issues fix for FortiClient EMS zero day CVE-2026-35616
Mon 6 Apr · 19:32 UTCCISACISA Adds CVE-2026-35616 to Known Exploited Vulnerabilities Catalogue
Mon 6 Apr · 17:08 UTCCISACISA Adds Fortinet FortiClient EMS Flaw CVE-2026-35616 to KEV
Mon 6 Apr · 15:27 UTCSOCRadarFortinet warns of critical CVE-2026-35616 flaw in FortiClient EMS
Mon 6 Apr · 09:51 UTCSecurityWeekFortinet Rushes Emergency Fixes for Exploited Zero-Day
Mon 6 Apr · 06:01 UTCSecurity AffairsCVE-2026-35616: Fortinet fixes actively exploited high-severity flaw
Sun 5 Apr · 05:51 UTCThe Hacker NewsFortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS
Tue 31 Mar · 11:50 UTCSecurityWeekExploitation of Critical Fortinet FortiClient EMS Flaw Begins
Mon 30 Mar · 11:09 UTCSecurity AffairsCritical Fortinet FortiClient EMS flaw exploited for Remote Code Execution
Wed 11 Feb · 10:05 UTCSecurityWeekFortinet Patches High-Severity Vulnerabilities
Tue 10 Feb · 06:35 UTCThe Hacker NewsFortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution
Mon 9 Feb · 21:55 UTCSecurity AffairsCritical Fortinet FortiClientEMS flaw allows remote code execution
Mon 9 Feb · 04:35 UTCSecurityOnlineEndpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE

Who reported 7 outlets, last 12 months

  • Security Affairs5
  • CISA5
  • The Hacker News4
  • SecurityWeek4
  • SecurityOnline3
  • SOCRadar2
  • Dark Reading1
  1. AI Agents Power Ransomware Affiliates’ Attacks on Edge DevicesThe Hacker News
  2. INC Ransomware Exposed Using AI and Custom Malware Against VictimsSecurityOnline
  3. AI-Driven Ransomware Campaign Targeted 62 OrganisationsSOCRadar
  4. FortiClient EMS flaw used to deploy EKZ Infostealer via fake patchSecurity Affairs
  5. FortiClient EMS bug exploited to deliver EKZ InfostealerSecurityWeek
  6. FortiClient EMS flaw used to drop EKZ Infostealer via fake updatesSecurityOnline
  7. CISA adds six KEV flaws amid active Fortinet exploitsThe Hacker News
  8. CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV listCISA · official notice
  9. CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV listCISA · official notice
  10. CISA adds critical Ivanti EPMM flaw to KEV after PoC releaseSecurity Affairs

All CVEs in coverage

2
CVE-2026-21643Fortinet FortiClient EMS SQL Injection VulnerabilityCVSS9.1CriticalExploited98%EPSS12articles
CVE-2026-35616Fortinet FortiClient EMS Improper Access Control VulnerabilityCVSS9.1CriticalExploited94%EPSS15articles
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device