Fortinet's Endpoint Management Server Has Been Under Attack Since March 31. The Patch Dropped Saturday. CISA Gave Federal Agencies Three Days. You Should Give Yourself Less.

WHAT HAPPENED

On March 31, watchTowr's honeypot infrastructure captured the first exploitation attempts against a previously unknown vulnerability in Fortinet's FortiClient Endpoint Management Server. The attackers were careful and methodical. WatchTowr's head of proactive threat intelligence, Ryan Dewhurst, described the initial behavior as "low and slow" exploitation, the kind of patient probing that suggests the attackers knew exactly what they had and were trying not to burn it.

Cybersecurity firm Defused independently identified the zero-day through its anomaly detection system and reported it to Fortinet under responsible disclosure. Fortinet moved quickly once notified, publishing an advisory and releasing an emergency hotfix on Saturday, April 4. But the math is unfavorable. Attackers had at least four days of unpatched exploitation before the fix existed, and not everyone patches on a holiday weekend.

CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities catalog on April 6 and gave federal agencies until April 9 to remediate. That is a three-day window, which is unusually aggressive even for CISA. The compressed timeline tells you everything you need to know about how seriously the government is treating this one.

WHY THIS IS WORSE THAN IT LOOKS

FortiClient EMS is not a random edge device. It is the centralized management platform that controls endpoint security policies, VPN configurations, application firewall rules, and compliance posture across an organization's entire device fleet. Compromising EMS does not give an attacker access to one machine. It gives them the ability to push policy changes, deploy configurations, and potentially reach every managed endpoint in the environment.

The vulnerability itself is classified as CWE-284, Improper Access Control. In practical terms, an unauthenticated attacker can send specially crafted API requests that bypass all authentication and authorization checks entirely. No credentials. No user interaction. No privilege escalation chain. One HTTP request, and the attacker has full control over endpoint management operations. The attack vector is network-based, the complexity is low, and the impact spans confidentiality, integrity, and availability. That combination is why it earned a 9.1 CVSS score.

Making this worse is the context. CVE-2026-21643, a separate critical SQL injection vulnerability in the same product, was disclosed by Fortinet on February 6 and confirmed under active exploitation by late March. Defused discovered both vulnerabilities. Researchers have not yet confirmed whether the same threat actors are chaining them, but two unauthenticated remote code execution paths in the same product within two weeks creates a situation where defenders are running remediation cycles faster than most organizations can schedule maintenance windows.

ATTACK CHAIN

WHO IS EXPLOITING THIS

Attribution has not been established for either the CVE-2026-35616 or CVE-2026-21643 exploitation campaigns. Defused's CEO Simo Kohonen told Dark Reading that the activity appears limited so far, but the scope could widen quickly now that a proof-of-concept exploit has appeared on GitHub. Tenable's Scott Caveza noted that given Fortinet's track record as a target and the availability of exploit code, exploitation will almost certainly increase.

The historical pattern supports that assessment. CISA has added ten Fortinet vulnerabilities to its KEV catalog since early 2025. Government-backed groups from Russia and China have previously targeted vulnerable FortiClient EMS instances. VulnCheck's Caitlin Condon noted that while FortiClient EMS has a relatively small internet-facing footprint compared to other Fortinet products, the value of what it controls makes it a disproportionately attractive target.

This pattern of critical infrastructure management platforms being targeted is something we have been tracking closely. Our April 4 coverage of the Cisco IMC CVE-2026-20093 authentication bypass highlighted the same dynamic: attackers going after the management layer that sits below or beside the operating system, where traditional security tooling has no visibility.

AFFECTED VERSIONS AND FIX

DEFENSE TAKEAWAYS