---
id: 7690
title: "CVE-2026-35616 & CVE-2026-21643 – Fortinet FortiClientEMS: Overview & Takeaways"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-35616-cve-2026-21643-fortinet-forticlientems-overview-takeaways/"
published_at: "2026-04-07T00:00:00Z"
tags: ["rce", "sqli", "cve-2026-35616", "fortinet", "cve-2026-21643", "in-the-wild", "auth-bypass", "forticlientems"]
phying_url: "https://phying.com/item/7690"
lang: en
---

# CVE-2026-35616 & CVE-2026-21643 – Fortinet FortiClientEMS: Overview & Takeaways

## Summary

Two actively exploited FortiClientEMS flaws: CVE-2026-35616, an unauthenticated API auth bypass to RCE in 7.4.5/7.4.6, and CVE-2026-21643, SQLi limited to 7.4.4 multi-tenant deployments.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2026-04-07T00:00:00Z
- **Original:** https://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-35616-cve-2026-21643-fortinet-forticlientems-overview-takeaways/
- **Phying News:** https://phying.com/item/7690