Fortinet has issued emergency and out-of-band patches for two (2) critical FortiClient Enterprise Management Server (EMS) vulnerabilities, led by CVE-2026-35616 (CVSS 9.1), an improper access control flaw that enables unauthenticated attackers to bypass API authentication and execute arbitrary code or commands via crafted requests, and the previously disclosed CVE-2026-21643, both of which are actively exploited in the wild. The latest vulnerability, discovered by Defused Cyber, was observed as a zero-day prior to disclosure, with exploitation attempts detected by watchTowr honeypots as early as March 31, 2026, while Shadowserver reported over 2,000 exposed EMS instances globally, increasing the risk of widespread compromise. Affecting FortiClient EMS versions 7.4.5 and 7.4.6, the flaw can be mitigated with hotfixes or by upgrading to version 7.4.7. The rapid succession of these unauthenticated vulnerabilities highlights sustained targeting of Fortinet infrastructure, though it remains unclear if the same threat actors are responsible or if the flaws are being chained. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-35616 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal patching by no later than April 9, 2026, while researchers warn that attackers are deliberately timing exploitation during holiday periods to exploit reduced security staffing, emphasizing that organizations should treat remediation as an immediate incident response priority.