CVE-2026-35616 covers reported active exploitation of critical vulnerabilities in Fortinet FortiClient EMS, with Fortinet having issued an emergency hotfix while a full patch remains pending; CVSS score and vulnerability class are unconfirmed from authoritative sources at this time, though the EPSS score of 0.2526 (96th percentile) reflects high exploitation probability. The management plane position of FortiClient EMS — controlling endpoint agents across the organization — means successful compromise has organizational-scale impact potential, making this a priority even without full technical confirmation. Organizations should apply the emergency hotfix immediately, restrict EMS interface access to trusted internal networks only, and monitor Fortinet PSIRT (https://www.fortiguard.com/psirt) actively for the full advisory and patch release. Note: technical details including affected versions and vulnerability class remain unconfirmed from NVD or CISA; confidence in full scope is medium pending official advisory publication.