FortiClient EMS 7.4.5: The Fix for One Critical Bug, the First Version Hit by the Next
FortiClient EMS 7.4.5 is the version Fortinet told administrators to move to in February to fix CVE-2026-21643. It is also the first version Fortinet listed as vulnerable to CVE-2026-35616 in April. Both bugs are critical, both are unauthenticated, and I have not covered either until now. This is a retrospective, written months after the second advisory, because the two advisories read together say something neither says alone.
Quick answer
- CVE-2026-21643 (FG-IR-25-1142, SQL injection): affects FortiClientEMS 7.4.4. Fixed in 7.4.5 or above.
- CVE-2026-35616 (FG-IR-26-099, API authentication bypass): affects FortiClientEMS 7.4.5 through 7.4.6. Fixed in 7.4.7 or above, with a hotfix for 7.4.5 and 7.4.6. Fortinet states it has seen this one exploited in the wild.
- FortiClientEMS 7.2 and 8.0 are listed as not affected by either. FortiClient Cloud and FortiSASE were remediated by Fortinet.
- Neither advisory lists a workaround.
Why FortiClient EMS matters
FortiClient EMS is the server that tells every managed endpoint what to do. It pushes policy, applies the ZTNA posture tags that my ZTNA post leans on, and acts as the endpoint half of the Security Fabric described in One Fabric, One Agent. A bug that lets an unauthenticated attacker run code or commands on that server is a bug in the thing every managed laptop trusts.
Everything below comes from Fortinet’s own advisory pages and the EMS 7.4.7 release notes. Where I rely on a third party, I name it. There is no exploit detail in this post and I will not be adding any.
The two FortiClient EMS advisories side by side
| FG-IR-25-1142 | FG-IR-26-099 | |
|---|---|---|
| CVE | CVE-2026-21643 | CVE-2026-35616 |
| Weakness | CWE-89, SQL injection | CWE-284, improper access control |
| Component | GUI | API |
| Attack type | Unauthenticated | Unauthenticated |
| Discovered | Internally, by Fortinet Product Security | Externally, reported by Simo Kohonen (Defused) and Nguyen Duc Anh |
| Published | 6 February 2026 | 4 April 2026 |
| Affected | FortiClientEMS 7.4.4 | FortiClientEMS 7.4.5 through 7.4.6 |
| Fixed in | 7.4.5 or above | 7.4.7 or above, hotfix for 7.4.5 and 7.4.6 |
| Workaround | None listed | None listed |
Both advisories carry the same CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C, and both show 9.1. That number is a temporal score. I ran the CVSS 3.1 formula on the vector: the base score is 9.8, and the exploit-code and remediation-level metrics bring it down to 9.1. The page is showing the adjusted figure, not the raw severity.
The overlap: fixed in 7.4.5, affected in 7.4.5
Read the Affected and Fixed rows together. The fix for CVE-2026-21643 is 7.4.5. The first version affected by CVE-2026-35616 is 7.4.5.
An administrator on 7.4.4 in February who did exactly what FG-IR-25-1142 said, upgrade to 7.4.5 or above, would have landed on a version that FG-IR-26-099 later listed as vulnerable. Moving to 7.4.6 did not help either, because the affected range runs through it. The only complete answer in April was the hotfix on the version already installed, followed by 7.4.7. Fortinet’s advisory says the hotfix “is sufficient to prevent it entirely” until 7.4.7 is available.
I should be careful about what this does and does not show. I found nothing from Fortinet or anyone else claiming the two bugs chain together, and I am not claiming it. They are different components, different weakness classes and different discoverers. The point is narrower. Patching to the version the last advisory named is not the same as being patched, and in this case the gap between the two advisories was eight weeks.
Is CVE-2026-35616 exploited in the wild?
Yes. Fortinet states it has observed exploitation, and its advisory page marks the vulnerability as known exploited. Horizon3 reports exploitation attempts against honeypots from 31 March, ahead of the advisory, with CISA adding the CVE to its Known Exploited Vulnerabilities catalogue on 6 April. Tenable notes a public proof of concept on GitHub that it had not verified. Horizon3 also reports Shadowserver counting roughly 2,000 internet-exposed EMS instances.
Is CVE-2026-21643 exploited? Fortinet’s page disagrees with itself
FG-IR-25-1142 is less clear. The advisory text says the flaw “has been observed to be exploited in the wild”, while its metadata table lists Known Exploited as “No”. The page’s timeline has two entries, both dated 6 February: the initial publication and the removal of FortiEMS Cloud from the affected list. The contradiction has been on the page since day one.
Arctic Wolf’s February bulletin found no exploitation and no public proof of concept at the time. NetSPI later describes both bugs as actively exploited and says the SQL injection applies to multi-tenant mode only. That multi-tenant detail is not on Fortinet’s advisory page. I am not going to pick a side on any of this. If you are deciding priority, treat CVE-2026-21643 as exploitable and check Fortinet’s current page for the latest status.
FortiClient EMS 7.4.7 upgrade notes and traps
The upgrade is not entirely clean, which matters if you are the one doing it.
- 7.4.7 was first released on 7 April 2026, three days after the advisory, and re-released on 10 April as build 2194.M to fix an upgrade issue. Build 2193.M is the one the release notes credit with making EMS no longer vulnerable to CVE-2026-35616. If you already run 2193.M you do not need 2194.M.
- If you upgraded to 7.4.6 from 7.4.4 or 7.4.5 and use RADIUS administrator login, OAuth 2 fabric connectors or scheduled remote backup, those features stopped working after that upgrade. The release notes say to install a hotfix, obtained from Fortinet Support, before moving to 7.4.7.
- EMS does not support downgrading.
- 7.4.7 does not support legacy 158 licences, and the installer blocks the upgrade if it finds one.
How to check and fix your FortiClient EMS
- Find out which EMS version and build you run, and compare it against the hotfix and the 7.4.7 build numbers in Fortinet’s release notes rather than assuming you are covered.
- Keep the EMS management and API surface off the internet. Fortinet lists no workaround for either bug, so exposure is the control you have.
- If an instance was exposed while on 7.4.5 or 7.4.6 before the hotfix, treat it as potentially compromised. Fortinet has published no indicators of compromise, so the detection you have is review of API activity and unexpected command execution on the EMS host.
- Read the licence and hotfix notes above before the upgrade window, not during it.
The pattern
This is the same shape I wrote about in the FortiSandbox chain post and in the FortiManager FGFM trust-model post: a management-plane product, unauthenticated reach, and an advisory that tells you what to install without telling you what the next advisory will say. Each advisory is correct on its own. The cost shows up only when you line them up in a timeline.