A Widespread and Active Threat Emerges

Security teams managing Fortinet’s infrastructure are facing a severe and immediate crisis. Researchers have confirmed that over two thousand instances of the FortiClient Enterprise Management Server (EMS) are exposed directly to the public internet, and they are under active attack. Threat actors are exploiting two critical, unauthenticated remote code execution (RCE) vulnerabilities to seize complete control of these systems, no passwords required.

The situation has escalated from a theoretical risk to a live operational emergency. The non-profit Shadowserver Foundation, which first sounded the alarm, reports observing in-the-wild exploitation of the flaws tracked as CVE-2026-35616 and CVE-2026-21643. Their public dashboard shows a stark global footprint of vulnerable servers, with the highest concentrations in the United States and Germany. This isn’t a waiting game; the attacks are happening now.

Why Unauthenticated RCE Spells Disaster

Let’s break down why this particular combination is so dangerous. “Unauthenticated” means an attacker needs no valid credentials, no stolen passwords, and no prior foothold. “Remote Code Execution” means they can run any command they choose on the underlying operating system. Combine them, and you have a scenario where a single, maliciously crafted HTTP request sent to an exposed server can hand over the keys to the kingdom.

Imagine a fortress where the main gate opens if you simply knock in a specific pattern, no key needed. That’s the level of access we’re discussing. For security administrators, this eliminates the usual early warning signs of brute-force attacks or credential stuffing, making the initial breach alarmingly silent and efficient for the attacker.

The Central Nervous System of Endpoint Security

To understand the full gravity, you must recognize what FortiClient EMS actually does. This isn’t just another server; it’s the central command and control for an organization’s entire endpoint security posture. IT and security teams use it to push antivirus updates, enforce web filtering policies, and manage secure remote access configurations across every corporate laptop, desktop, and mobile device.

In essence, it’s the trusted brain that tells all the endpoint “muscles” what to do. Compromising this server is not like infecting a single user’s laptop. It’s like hijacking the air traffic control tower at a major airport. The attacker inherits the system’s inherent trust and authority, which opens up devastating possibilities.

The Domino Effect of a Compromised EMS

Once an adversary controls the EMS, the trusted relationship it has with every managed endpoint becomes a weapon. They can silently push ransomware or spyware to thousands of devices simultaneously, using the organization’s own trusted distribution channels. They can disable endpoint protection software on those devices, effectively blindsiding the defense before launching a secondary attack.

Perhaps most insidiously, they can maintain persistent, hidden access. Since the endpoints are programmed to obey commands from the EMS, malicious instructions often bypass standard security alerts. The security tools see the commands coming from their legitimate management server, so why would they flag them? This trusted-path attack makes post-compromise detection incredibly difficult, allowing threats to linger and spread.

From Misconfiguration to Catastrophe

Leaving a critical management interface like FortiClient EMS exposed to the open internet is, frankly, a dangerous misconfiguration in any context. It violates the fundamental principle of least-privilege access. However, doing so while active exploits for critical RCE flaws are circulating transforms a bad practice into a five-alarm fire.

The exposed servers, visible through internet-wide scans, present a low-hanging, high-value target for both targeted attackers and opportunistic ransomware gangs. The geographic spread indicates this is not an isolated issue for a single industry but a systemic problem affecting organizations worldwide. The concentration in technologically advanced nations like the U.S. and Germany underscores that even sophisticated IT environments can fall prey to basic oversights.

An Urgent Call to Action for Defenders

For organizations using FortiClient EMS, this must be treated as a P0 (priority-zero) incident. Immediate action is non-negotiable. The first and most critical step is to apply Fortinet’s latest security patches for CVE-2026-35616 and CVE-2026-21643 without delay. This patching operation should take precedence over all other scheduled maintenance.

Patching alone, however, is not a complete strategy. Teams must immediately audit their network perimeter. Any rule allowing direct internet access to the EMS management interface must be revoked. Access should be restricted to trusted internal networks only, with administrative connections forced through a secure VPN gateway. This network hygiene step is crucial to prevent the next wave of attacks targeting future vulnerabilities.

Looking Beyond the Immediate Fix

In the frantic rush to patch and lock down, don’t forget to look for signs that the barn door was already open. Security teams need to conduct a thorough forensic review of their EMS server logs. They should hunt for anomalous activity, unexpected outbound connections, or unauthorized policy changes that might indicate a prior, silent compromise during the window of exposure.

Furthermore, this incident serves as a painful but valuable lesson in architectural segmentation. The management plane for security tools should never reside on the same network segment as general user traffic or production servers. Implementing strict network segmentation around management infrastructure can contain a breach, limiting an attacker’s ability to move laterally from the EMS server to other critical assets.

The fallout from this Fortinet vulnerability is a stark reminder that our security tools themselves can become potent attack vectors if not managed with extreme care. As the industry continues to consolidate management into powerful central platforms, the security of those platforms must be paramount. The future of enterprise defense will depend not just on the tools we buy, but on how rigorously we enforce the principles of zero-trust and minimal exposure around the very systems we trust to protect us.