Security software vulnerabilities create an uncomfortable reality for business owners: the tools designed to protect your systems can become valuable targets themselves.
Fortinet provided a clear example in 2026.
A critical vulnerability in FortiClient Endpoint Management Server, or FortiClient EMS, was added to CISA’s Known Exploited Vulnerabilities catalog after reports of active exploitation. Tracked as CVE-2026-35616, the flaw could allow an unauthenticated attacker to execute unauthorized code or commands against affected EMS deployments.
The lesson for a small Texas business is not “Fortinet is unsafe.”
The lesson is more practical:
Anything powerful enough to manage your security deserves to be secured, updated, monitored, and reviewed like critical infrastructure.
What Is FortiClient EMS?
FortiClient EMS is a centralized management platform used to manage FortiClient endpoints.
Administrators can use it to deploy policies, monitor devices, manage endpoint settings, support Zero Trust Network Access configurations, and oversee security functions across many systems.
That makes it useful.
It also makes it powerful.
A management server with authority over many endpoints is naturally more sensitive than an ordinary employee workstation.
If attackers compromise the management layer, they may gain a position that affects far more than one computer.
What Happened With CVE-2026-35616?
Fortinet disclosed CVE-2026-35616 in April 2026.
The vulnerability affected FortiClient EMS 7.4.5 and 7.4.6 and involved improper access control.
Security agencies reported that exploitation could allow an unauthenticated attacker to execute unauthorized code or commands through specially crafted requests.
The Cyber Security Agency of Singapore rated the issue critical and cited a CVSS score of 9.8 out of 10.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on April 6, 2026.
That means defenders were not dealing with a purely theoretical weakness.
Exploitation had been observed in the wild.
Fortinet Released a Fix
Fortinet published hotfix guidance for affected FortiClient EMS installations.
The company’s release notes state that FortiClient EMS 7.4.6 with GA hotfix 1 is no longer vulnerable to CVE-2026-35616.
Security agencies also advised affected organizations to install the appropriate hotfix and move to corrected releases as they become available.
This is exactly how vulnerability management is supposed to work:
Find the weakness. Publish the advisory. Release the fix. Apply it.
The problem begins when nobody knows who is responsible for the last step.
The Security Tool Is Often a High-Value Target
Attackers do not categorize technology the way business owners do.
You may think:
“This is our security system.”
The attacker may think:
“This system already has trusted access to dozens of endpoints.”
Management platforms can hold:
- Administrator accounts
- Endpoint inventories
- Security policies
- Network information
- Deployment capabilities
- Certificates
- Remote-management functions
- Connections to identity or cloud systems
That concentration of authority makes management software an attractive target.
This Is Bigger Than Fortinet
The broader lesson applies to many tools small businesses rely on.
Examples include:
- Remote monitoring and management platforms
- Endpoint management systems
- Backup consoles
- Firewalls
- Password-management administration portals
- Microsoft 365 administrator accounts
- Cloud-management dashboards
- Network controllers
- Remote support tools
If a system can push software, reset accounts, restore files, change policies, or remotely control computers, it belongs in the business’s highest-priority security tier.
“We Bought Security Software” Is Not the Finish Line
Small businesses sometimes think of cybersecurity as a purchasing decision.
Buy antivirus.
Install a firewall.
Add backups.
Use a password manager.
Those are good steps.
However, security products are still software.
Software requires:
- Updates
- Configuration
- Account management
- Monitoring
- Access control
- Vendor advisory review
A security tool that has not been updated or reviewed for years can become part of the problem it was purchased to solve.
Patch the Management Plane First
Not every update has equal urgency.
A vulnerability in a low-risk desktop application may not carry the same business impact as a remotely exploitable flaw in the system controlling hundreds of endpoints.
That is why patch management should consider:
- Whether exploitation is active
- Whether the service is internet accessible
- Whether authentication is required
- The permissions of the affected service
- How many systems the platform can control
- Whether a workaround exists
When CISA adds a vulnerability to the Known Exploited Vulnerabilities catalog, it is a strong signal that remediation deserves attention.
Do Not Expose Management Systems Without a Reason
Internet-facing management interfaces deserve special scrutiny.
A management console should not be publicly reachable simply because remote access is convenient.
Businesses should ask:
- Does this console actually need internet exposure?
- Can access be restricted to known IP addresses?
- Can administrators use a VPN?
- Is MFA enabled?
- Are default accounts disabled?
- Are logs reviewed?
- Is the software version current?
Reducing exposure removes attack opportunities before a vulnerability is even discovered.
Administrator Accounts Need Stronger Protection
The more powerful the platform, the more carefully its administrator accounts should be protected.
At minimum, businesses should use:
- Unique administrator passwords
- A business password manager
- MFA wherever supported
- Separate daily-use and administrative accounts
- Prompt removal of former employees and vendors
- Regular account reviews
Password-first security becomes even more important when one account can control many systems.
Backups and Security Tools Have Something in Common
Both exist to protect the business.
Both can also become attractive targets.
An attacker who compromises a backup console may interfere with recovery.
Also an attacker who compromises an endpoint-management system may reach devices.
And an attacker who compromises a password-management administrator may try to weaken account security.
That is why protective systems need protection of their own.
Know What Security Tools You Actually Have
A surprising number of small businesses cannot produce a current inventory of their security systems.
They may know the name of their antivirus but not:
- Who manages it
- When it was last updated
- Whether every device is enrolled
- Whether alerts are monitored
- Who receives critical notices
- Whether the management console is exposed
That makes fast response difficult when a vendor releases an urgent advisory.
A basic IT inventory should include the product, version, owner, administrator, renewal status, and update responsibility.
Security Vendors Need Monitoring Too
No reputable vendor can promise that its products will never contain vulnerabilities.
The better question is how quickly vulnerabilities are identified, disclosed, fixed, and deployed.
Your business or IT provider should have a way to watch for important vendor security notices.
That includes the systems protecting:
- Endpoints
- Identity
- Networks
- Backups
- Remote access
Waiting until a vulnerability appears in mainstream news can waste valuable time.
What Should a Small Business Do?
- Inventory your security tools. Know which products protect the business and who manages each one.
- Identify the management consoles. These systems deserve higher priority because they can affect many devices or accounts.
- Review internet exposure. Remove unnecessary public access to administration interfaces.
- Protect administrator identities. Use unique passwords, MFA, and separate admin accounts.
- Track vendor advisories. Make sure someone is responsible for evaluating urgent security updates.
- Prioritize exploited vulnerabilities. A known exploited flaw deserves faster attention than a theoretical low-impact issue.
- Verify the update. Do not assume a patch installed successfully across every system.
Frequently Asked Questions
CVE-2026-35616 is a critical improper-access-control vulnerability affecting FortiClient EMS 7.4.5 and 7.4.6. It could allow an unauthenticated attacker to execute unauthorized code or commands through crafted requests.
Yes. Security agencies reported active exploitation, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog in April 2026.
No. Vulnerabilities affect software from many vendors. The useful lesson is that security products also require active patching, secure configuration, account protection, and monitoring.
Management servers often have authority over many endpoints, policies, users, or security settings. A compromise can therefore create broader access than compromising one employee computer.
Only when there is a justified requirement and appropriate controls. Businesses should restrict administrative access as much as practical and use secure remote-access methods.
Assign responsibility to an internal administrator or managed IT provider. Maintain an inventory, watch vendor advisories, prioritize actively exploited vulnerabilities, install updates, and verify successful deployment.
Your Security Stack Needs Maintenance Too
The FortiClient EMS incident is useful because it challenges a common assumption.
Security software is not a set-it-and-forget-it purchase.
It is part of your infrastructure.
It needs patching, strong administrator accounts, restricted access, monitoring, and someone accountable for keeping it current.
SofTouch Systems helps small Texas businesses manage endpoints, antivirus, patching, passwords, backups, remote support, and the systems behind those protections.
If you are not sure who is responsible for updating and reviewing your business’s security tools, start with a free 15-minute IT security check.
The tools protecting your business deserve protection too.
Sources:
- Fortinet: FortiClient EMS 7.4.6 special notices
- Canadian Centre for Cyber Security: CVE-2026-35616 alert
- Cyber Security Agency of Singapore: Active exploitation of FortiClient EMS vulnerability
- Fortinet PSIRT advisories
Discover more from SofTouch Systems
Subscribe to get the latest posts sent to your email.