Urgent Warning: Over 2,000 FortiClient EMS Instances Exposed and Actively Exploited

The digital landscape is currently gripped by a critical cybersecurity incident involving FortiClient Enterprise Management Server (EMS) instances. Recent findings from the Shadowserver Foundation reveal a staggering number of these servers, over 2,000 globally, are publicly accessible online. More alarmingly, at least two of these exposed instances are confirmed to be under active exploitation through severe unauthenticated Remote Code Execution (RCE) vulnerabilities. This situation demands immediate attention from IT professionals and security teams managing FortiClient EMS environments.

The Critical Vulnerabilities: CVE-2026-35616 and CVE-2026-21643

At the heart of this urgent warning are two critical vulnerabilities: CVE-2026-35616 and CVE-2026-21643. Both are classified as unauthenticated RCE flaws. This distinction is crucial; “unauthenticated” means an attacker does not need legitimate credentials to execute malicious code on the target system. This significantly lowers the barrier for attackers, allowing them to gain control over vulnerable EMS instances with relative ease. The potential impact of successful exploitation includes data theft, system compromise, deployment of ransomware, or establishment of persistent access within enterprise networks.

Understanding the Risk: Why Public Exposure Matters

The sheer number of publicly accessible FortiClient EMS instances, exceeding 2,000, amplifies the risk posed by these RCE vulnerabilities. Public exposure means these servers are discoverable via internet scanning tools, making them prime targets for malicious actors actively searching for vulnerable systems. An unpatched, internet-facing EMS instance represents a significant entry point into an organization’s network, undermining endpoint security management and potentially compromising thousands of connected devices. The confirmation of active exploitation further underscores the immediate and severe threat.

Who is Affected?

Organizations utilizing FortiClient Enterprise Management Server (EMS) are potentially affected. This includes a broad range of businesses and institutions that rely on FortiClient for endpoint protection, central management, and policy enforcement across their networked devices. Any EMS instance that is directly accessible from the public internet, particularly if it has not been updated with the latest security patches, is at severe risk.

Remediation Actions: Securing Your FortiClient EMS

Immediate action is imperative for all administrators of FortiClient EMS instances. Proactive remediation can prevent exploitation and mitigate potential damage. Here are the critical steps:

• Patch Immediately: Apply all available security updates and patches from Fortinet for your FortiClient EMS. Prioritize patches addressing CVE-2026-35616 and CVE-2026-21643. Refer to Fortinet’s official security advisories for specific versions and update paths.
• Limit Network Exposure: Restrict public internet access to FortiClient EMS to the absolute minimum required. Ideally, EMS should only be accessible from trusted internal networks via VPN or a tightly controlled and audited boundary. Implement robust firewall rules to filter incoming traffic.
• Review Network Segmentation: Ensure proper network segmentation is in place. If an EMS instance is compromised, good segmentation can limit an attacker’s ability to move laterally within the network.
• Implement Intrusion Detection/Prevention Systems (IDS/IPS): Deploy and ensure IDS/IPS are configured to detect and block known attack patterns targeting FortiClient EMS vulnerabilities.
• Conduct Vulnerability Scans: Regularly scan your external and internal networks for exposed FortiClient EMS instances and other vulnerabilities.
• Monitor Logs: Continuously monitor FortiClient EMS logs and surrounding network traffic for suspicious activity, unusual access patterns, or signs of compromise.
• Backup Critical Data: Maintain regular backups of your EMS configuration and data, and ensure these backups are stored securely and offline.

Tools for Detection and Mitigation

Leveraging appropriate tools is vital for identifying and addressing these vulnerabilities.

Tool Name	Purpose	Link
Shadowserver Scanner	Identifies publicly exposed FortiClient EMS instances.	Shadowserver Foundation Advisory
Fortinet Security Fabric	Comprehensive security platform for patching and monitoring FortiGate and FortiClient EMS.	Fortinet Security Fabric
Vulnerability Scanners (e.g., Nessus, OpenVAS)	Identifies known vulnerabilities on network-connected devices, including FortiClient EMS.	Nessus / OpenVAS
IDS/IPS Solutions	Detects and prevents exploitation attempts at the network level.	(Vendor-specific, e.g., Snort, Suricata, FortiGate IPS)

Conclusion

The exposure of over 2,000 FortiClient EMS instances and the confirmed active exploitation of RCE vulnerabilities CVE-2026-35616 and CVE-2026-21643 represent a severe threat to organizations globally. Administrators must prioritize patching these systems, drastically reduce their network exposure, and implement robust monitoring and security controls. Timely action is the strongest defense against potential compromise and the significant operational and reputational damage that can ensue from a successful RCE attack.