New FortiClient EMS flaw exploited in attacks, emergency patch released

CVE-2026-35616 is a critical pre-authentication improper access control vulnerability in FortiClient EMS being actively exploited; Fortinet released weekend hotfixes for FortiClient EMS 7.4.5 and 7.4.6 and will include the fix in 7.4.7. Shadowserver identified over 2,000 exposed EMS instances (majority in the USA and Germany), and the flaw was disclosed by Defused after observed zero-day exploitation; Fortinet also noted a separate critical EMS CVE (CVE-2026-21643) last week. Fortinet urges immediate installation of hotfixes or upgrade to 7.4.7 to mitigate risk of compromise.

Analysis

This event is a liquidity and confidence shock to a vendor whose product sits on many enterprise endpoints; expect a multi-stage market response — an immediate repricing of perceived outsized tail risk followed by a protracted “patch tax” on customers that shows up as higher implementation and managed-service spend over the next 1–3 quarters. That patch tax is two-sided: it depresses near-term gross margins for the vendor (free or discounted remediation, accelerated support) while creating a near-term revenue opportunity for MSSPs, SI firms and consultancies that manage large-scale remediation campaigns.

Competitive dynamics favor cloud-native and endpoint detection vendors in the medium term as corporate buyers look to diversify single-vendor dependency. Incumbent competitors that can offer migration programs and ‘assume the risk’ managed services (technical account teams, free migration credits) will capture disproportionate wallet share in 6–18 months; expect targeted enterprise sales incentives and bundled migration offers from those players.

Tail risks include material breach disclosure, regulatory/contractual penalties and insurance claims that could compress margins and force conservative guidance — these outcomes would manifest within days-to-weeks of any confirmed data exfiltration and influence quarterly guidance next quarter. Reversal catalysts are straightforward and time-limited: rapid telemetry proving no mass exploitation, transparent incident remediation, or a clear, low-cost migration pathway that preserves ARR; each would materially blunt downside within 4–8 weeks.

Finally, implied volatility in the vendor’s options will spike; that creates defined-risk ways to express a negative near-term view while limiting exposure to an overdone selloff. Position sizing should be tactical — the structural ARR and product stickiness argue against large, permanent short allocations but justify short-duration, event-driven trades.

Key Decisions for Investors

• Tactical short FTNT via options: buy a 3-month put spread (buy 1x 15% OTM put, sell 1x 30% OTM put) sized to 1–2% portfolio risk. R/R: limited debit with 3–4x payoff if shares gap lower on churn/guidance hit within 1–3 months.
• Pair trade: long PANW (Palo Alto Networks) 3–6 month exposure vs short FTNT equal notional. Thesis: migrate share gains to cloud-centric security providers; target 8–12% relative outperformance, stop-loss at 6% adverse move.
• Buy selective exposure to CrowdStrike (CRWD) or Zscaler (ZS) on dips, 6–12 month horizon: expect incremental enterprise migrations and premium multiple expansion if flow-of-funds shifts from appliance to cloud-native security. Position size 1–3% each, take profits on 15–20% moves.
• If looking for defensive upside, allocate to MSSP/consulting exposure (smaller caps or specific lines within larger IT services names) for 1–2 quarter capture of remediation spend; prefer contractors that can scale SOC/MDR quickly and bill at premium rates.
• Risk-manage all positions: set alerts for any confirmed data-exfiltration announcements (days), quarterly guidance adjustments (weeks), and 4–8 week patch adoption telemetry — tighten stops or hedge if two of these materialize.