FortiClient EMS Flaw Sees Fresh Exploitation After April Hotfix
Attackers are still hitting a critical FortiClient EMS vulnerability that Fortinet patched, and flagged as actively exploited, months ago.
Key points
- Fortinet issued hotfixes in April 2026 for a critical FortiClient EMS vulnerability already being exploited in the wild.
- Fresh attacks on the same flaw show that a meaningful portion of the install base has not yet patched.
- FortiClient EMS influences device-trust decisions in network access control, so compromise reaches beyond the endpoint.
- Patching is the relevant control here; credential hygiene does not address a server-level pre-auth flaw.
- Organizations still running the unpatched version should apply the April hotfix immediately.
What is FortiClient EMS and why does this flaw matter?
FortiClient EMS is an endpoint management server: it handles device registration, policy enforcement, and posture checks for FortiClient endpoints. From an identity standpoint it sits at an interesting junction, because it influences whether a device is trusted enough to participate in network access control decisions. Compromise is not just an endpoint problem; it can corrupt the access decisions that flow downstream from it.
Should you worry about the exploitation timing?
Fortinet's April advisory classified this as zero-day exploitation at the time of disclosure. Defenders were already behind when the fix dropped. The company urged immediate patching. Some organizations listened; others, clearly, did not, and that unpatched remainder is now the target pool.
The pattern is familiar across the vulnerability landscape we track. When a vendor ships a hotfix alongside an in-the-wild warning, the organizations that patch within weeks are fine. The ones that don't become the next wave's fuel, and attackers need no new tooling to reach them.
We reported on Cisco Secure Workload drawing the same advice to patch immediately back in May, and the dynamic here is identical: fast vendor response, uneven customer follow-through.
Would stronger authentication have blocked this?
Honestly, it depends on the attack vector. If the vulnerability permits unauthenticated remote code execution at the server level, which critical-rated EMS flaws have done before, then no amount of MFA on user accounts would have blocked it. The authentication layer simply is not what is being targeted; the server process itself is. Security teams triaging risk should treat patching as the operative control, not credential hygiene.
What should defenders do right now?
Fortinet's response cadence on critical vulnerabilities has generally been fast. Customer patching cadence has not always kept pace, and that gap is where most enterprise damage lands. It is not novel. It is just painful.
If your organization runs FortiClient EMS and has not applied the April hotfix, that is the entire action item.
