2,000+ FortiClient EMS Instances Exposed Online as Attackers Exploit Active RCE Flaw

Cybersecurity researchers have issued an urgent warning for organizations using Fortinet’s FortiClient Enterprise Management Server (EMS).

Over 2,000 instances of this critical administrative tool are currently exposed to the public internet. Threat actors are actively exploiting severe vulnerabilities to take full control of these systems.

These security gaps are tracked as CVE-2026-35616, which is a newly discovered threat, and CVE-2026-21643. Both are classified as unauthenticated Remote Code Execution (RCE) vulnerabilities.

In simple terms, this means an attacker does not need to steal a username or guess a password to break into the network.

By simply sending a specially crafted request over the internet to a vulnerable FortiClient EMS server, hackers can run malicious commands and completely take over the underlying operating system.

The Shadowserver Foundation, a leading nonprofit security research group, recently detected active, in-the-wild exploitation of two critical flaws.

Global Exposure Data

According to Shadowserver’s public tracking dashboard, thousands of organizations have mistakenly left their FortiClient EMS servers directly accessible from the outside world.

Their internet scanning data reveals that approximately 2,000 servers are currently visible and at risk globally.

The exposure is geographically widespread, but the United States and Germany hold the highest concentrations of vulnerable instances.

Leaving a central management server exposed to the public internet is a dangerous practice on its own. Doing so while active exploits are circulating creates a critical emergency for IT teams.

FortiClient EMS is a centralized tool designed to manage endpoint security across an entire corporate network.

IT administrators use it to handle antivirus settings, web filtering rules, and secure remote access policies for employee devices.

If cybercriminals compromise an EMS server, they gain a powerful, trusted foothold into the broader corporate environment.

Attackers can abuse this centralized management capability to push malware, disable security software on user laptops, or deploy devastating ransomware across the organization.

Because employee devices inherently trust instructions coming from the EMS server, these malicious commands often execute without triggering typical security alarms.

Organizations utilizing Fortinet’s EMS must act quickly to secure their infrastructure before threat actors find their exposed systems.

The most critical step is to apply the latest security patches provided by Fortinet to eliminate the threat from CVE-2026-35616 and CVE-2026-21643.

IT administrators should also immediately review their firewall and network configurations. Management interfaces for FortiClient EMS should never be exposed directly to the public internet.

Access must be strictly isolated to trusted internal networks or secured behind a properly configured Virtual Private Network (VPN).

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.