Database/Control plane, storage & DevOps
Fortinet FortiClient EMS: Improper access control
CVSS 9.8CVE-2026-35616Control plane, storage & DevOpsKnown exploitedcurated
Impact
Improper access control -> unauthenticated code execution via crafted requests
Who can reach it
Network (remote)
What to do
Control-plane: patch FortiClientEMS 7.4.5-7.4.6
References
Related entries
- Fortinet FortiClient EMS: Unauthenticated SQL injectionCVE-2023-48788 · Fortinet FortiClient EMSCritical
- Fortinet FortiClient EMS: Unauthenticated SQL injectionCVE-2026-21643 · Fortinet FortiClient EMSCritical
- Fortinet FortiSandbox: OS command injection via crafted HTTP requestsCVE-2026-39808 · Fortinet FortiSandboxCritical
- VMware Avi Load Balancer: authentication bypass grants network access to the Avi control planeCVE-2026-47865 · VMware Avi Load Balancer (Avi Controller authentication)Critical
- rclone (rcd remote control server): An unauthenticated request to the rclone remote-control server instantiates aCVE-2026-49980 · rclone (rcd remote control server)Critical
- Proxmox VE (libpve-storage-perl XXE): XML external entity injection in the Proxmox storage library, reachableCVE-2026-51080 · Proxmox VE (libpve-storage-perl XXE)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.