Fortinet has shipped an emergency patch for a critical improper-access-control flaw in FortiClient Endpoint Management Server (EMS), CVE-2026-35616 (CVSS 9.1), that lets an unauthenticated attacker execute code through crafted requests. EMS is the console that manages your endpoint agents, so a compromise here reaches down to every managed device, not just one server.
Why a management server is the prize
EMS is central management by design: it pushes policy and software to the endpoints it controls. That is the same blast radius that makes RMM and MSP platforms such high-value targets. Take the console and you inherit trusted, privileged reach into the fleet, the shortest route from one flaw to mass compromise.
Unauthenticated code execution on an internet-reachable management box is the worst combination on offer. There is no credential to steal first and nothing to phish; a crafted request is the whole attack.
Why it matters beyond the patch
Perimeter management systems are frequently exposed ‘temporarily’ and then forgotten, which is exactly how mass exploitation finds them. Finding those forgotten exposures before an attacker does is the core of external network penetration testing, while the fleet-wide reach a compromised console grants is what an assumed-breach assessment is designed to measure.
What to do now
- Apply Fortinet’s emergency patch immediately and confirm the EMS console is not reachable from the public internet.
- Review who and what can talk to EMS with a firewall configuration review; management planes should be segmented, not flat.
- Hunt for signs of push abuse: unexpected policy or software deployments to endpoints, and new administrative sessions.
- Map how far a console takeover would spread with internal network penetration testing.
- For regulated entities, fold this into your NIS2 and DORA readiness, where management-plane exposure is a reportable risk.
The takeaway
A flaw in the box that manages every endpoint is not one vulnerability, it is a broadcast channel for the attacker. Patch EMS now, pull the console off the perimeter, segment the management plane, and test how far a takeover would actually reach.