Fortinet's FortiClient Enterprise Management Server (EMS) software is facing active exploitation of two critical vulnerabilities, including a fresh zero-day that facilitates unauthenticated remote code execution. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to secure their FortiClient EMS instances by Friday, April 6, 2026.
The vendor has issued an emergency hotfix and promised a full patch for the actively exploited vulnerabilities. This represents a significant security risk for organizations using Fortinet's endpoint management solutions, as attackers can gain unauthorized access and execute commands remotely without authentication.
