Zero-Day Rush: Fortinet's Emergency Patch Reveals the Relentless Hunt for Network Weaknesses

On a quiet weekend, as many IT teams were off the clock, a high-stakes cyber drama was unfolding. Fortinet, a heavyweight in network security, issued an urgent hotfix for a zero-day vulnerability-one that had already been weaponized in the wild. For organizations relying on FortiClient EMS, the clock was ticking: patch now, or risk becoming the next headline in a string of relentless cyberattacks targeting the vendor’s products.

Fast Facts

• Fortinet disclosed CVE-2026-35616, a critical zero-day vulnerability in FortiClient EMS, with a 9.1 CVSS score.
• The flaw enables unauthenticated attackers to execute code or commands via crafted requests, bypassing API authorization.
• The vulnerability was discovered by cybersecurity firm Defused, using an anomaly-detection tool called Radar.
• Exploitation appears limited so far, but a public proof-of-concept exploit has surfaced on GitHub.
• CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating patching for federal agencies by April 9.

The Anatomy of a Weekend Emergency

The newly revealed CVE-2026-35616 is no ordinary bug-it’s a critical improper access control flaw that allows attackers to sidestep authentication barriers and execute malicious code on vulnerable systems. Discovered by Simo Kohonen, CEO of Defused, and researcher Nguyen Duc Anh, the vulnerability affects FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. Fortinet’s rapid response included a hotfix, with a promise that the forthcoming EMS 7.4.7 release will contain a permanent fix.

What makes this incident particularly alarming is the speed and sophistication with which attackers exploit Fortinet products. The flaw was spotted thanks to Defused’s "Radar"-an anomaly detection system that sifts through massive volumes of honeypot data to flag suspicious activity. The tool had previously detected attacks on other high-profile vulnerabilities, underscoring the constant surveillance and opportunism of threat actors.

Fortinet: A Magnet for Attackers

This is not an isolated event. In recent months, Fortinet has repeatedly found itself in the crosshairs, with attackers exploiting zero-day flaws in products like FortiCloud, FortiSIEM, and FortiWeb. Sometimes, even in the absence of fresh vulnerabilities, hackers have leveraged weak credentials and exposed ports to compromise hundreds of FortiGate devices-demonstrating that persistence, not just technical prowess, is the hallmark of today’s adversaries.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has responded by adding the latest zero-day to its Known Exploited Vulnerabilities catalog, effectively putting federal agencies on notice: patch or face the consequences. Meanwhile, the emergence of public proof-of-concept code on platforms like GitHub raises the stakes for organizations slow to update.

Conclusion: The Patch Race Never Ends

The Fortinet zero-day saga is a stark reminder that in the cat-and-mouse game of cybersecurity, there is no finish line-only a constant race to patch, detect, and defend before attackers can strike. As tools like Radar become more sophisticated, defenders gain new ways to spot trouble early. But as long as vulnerabilities exist-and attackers remain vigilant-the weekend emergencies will keep coming.

WIKICROOK

• Zero: A zero-day vulnerability is a hidden security flaw unknown to the software maker, with no fix available, making it highly valuable and dangerous to attackers.
• CVSS Score: A CVSS Score rates the severity of security vulnerabilities from 0 to 10, with higher numbers indicating greater risk and urgency for response.
• Proof: A Proof-of-Concept (PoC) is a demonstration showing that a cybersecurity vulnerability can be exploited, helping to validate and assess real risks.
• Honeypot: A honeypot is a fake system set up to attract cyber attackers, enabling organizations to study attack methods without endangering real assets.
• API Authorization Bypass: API authorization bypass is a flaw allowing attackers to access or control APIs without the required permissions, risking sensitive data and application security.