CVE-2026-35616

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Scoring

Severity

CRITICAL

CVSS base score

9.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

EPSS probability

90.75%

CISA KEV

Known exploited vulnerability

CWE

CWE-284

Published

2026-04-04

Last modified

2026-07-08

Affected products

• Fortinet FortiClientEMS

Weakness type

• CWE-284

Related vulnerabilities

• CVE-2026-50165 — alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
• CVE-2026-86774 — Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
• CVE-2026-19625 — IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
• CVE-2026-75998 — ColdFusion | Improper Access Control (CWE-284)
• CVE-2026-86672 — ningzichun Student Management System Backup example.7z information disclosure
• CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
• CVE-2026-77487 — SQL Server Elevation of Privilege Vulnerability
• CVE-2026-73028 — SQL Server Elevation of Privilege Vulnerability

Markdown version · Browse all CVEs