CVE-2026-35616 is an improper access control vulnerability in FortiClientEMS with a CVSS 9.8 rating—but the score understates the organizational risk because this flaw targets the management infrastructure itself, not a single endpoint. Exploitation grants API-level access to the EMS interface, and from there an attacker may be able to push configurations or code to every enrolled client. This isn't lateral movement; it's potential command authority over your entire endpoint fleet, making this closer to a supply-chain event than a typical server compromise.
The vulnerability class matters here. Improper access control means authentication was never correctly enforced on certain endpoints—not a bypass, but an architectural gap. Patching closes the hole but doesn't restore design assumptions that were likely never validated against real-world deployment contexts. The EPSS score of 0.8894 places this among the highest-probability exploits I've seen, and it appears on the CISA KEV, confirming active exploitation.
Immediate priorities: First, verify whether your EMS instance runs with elevated service account privileges. The downstream blast radius—whether attackers can push malicious payloads to managed endpoints—depends entirely on this configuration state. If the service runs with high privileges, assume downstream compromise is possible until proven otherwise. Second, isolate the management interface (port 8013 by default) from untrusted network segments immediately; network segmentation is genuinely effective because exploitation requires reaching this interface. Third, deploy detection for anomalous REST API calls to port 8013 from unexpected sources—this is the highest-fidelity detection angle.
The harder question is forensic: distinguish between opportunistic scanning and pre-existing compromise of the management plane by examining whether exploitation activity predates the CISA KEV listing date. Standard IOCs from public PoCs may miss TTPs used in earlier campaigns. Given the exploitation velocity implied by EPSS, organizations likely don't have weeks to build instrumentation—assess your compensating controls realistically and prioritize patching.