FortiClient EMS: Critical code-injection vulnerability is being exploited

CVE-2026-35616 (CVSS 9.8) is a critical FortiClient EMS access-control/code-injection vulnerability that Fortinet says is being exploited in the wild. Fortinet released hotfixes for FortiClient EMS 7.4.5 and 7.4.6 (7.4.7 forthcoming) and says only the 7.4 branch is affected; 7.2 is not vulnerable. No exploit details or IOCs have been published, but administrators should apply patches immediately — expect operational/patching costs and potential short-term reputational risk to Fortinet if customers delay. Continuous monitoring for follow-up disclosures is advised.

Analysis

This incident will act as a short, sharp liquidity and operational stress test for customers and channel partners rather than an immediate revenue shock to the vendor. Expect concentrated weekend labor costs, emergency patch orchestration and extra incident-response retainers to show up in channel partner billings over the next 7–30 days, shifting some discretionary security spend into tactical remediation budgets.

A clear second-order beneficiary cohort: cloud-native endpoint/XDR vendors and MSSPs that can promise faster, centrally-managed remediation and forensic visibility. Over a 1–6 month window, procurement teams will fast-track pilots with vendors that demonstrably reduce mean-time-to-remediate; that can translate to a 3–10% reallocation of renewal dollars in mid-market customers and larger tender delays for incumbent appliances.

Tail risks are asymmetric and concentrated in legal/regulatory outcomes — a widespread breach with customer data loss would compress multiple quarters of margin and invite contract penalties, while the absence of broad exploitation should see sentiment snap back within 4–8 weeks. A practical near-term reversal would be clear, public IOC evidence showing limited scope or speedy mitigation metrics from third-party telemetry vendors, which would materially reduce the sell-side narrative.

Key Decisions for Investors

• Pair trade (4–12 week horizon): Short FTNT stock equal notional / Long CRWD stock. Rationale: rotation to cloud-native endpoint leaders. Position sizing: 1–2% portfolio each leg; stop-loss 8–12% on the short FTNT leg, take-profit on pair at 20–35% relative outperformance.
• Defined-risk hedge (0–8 week horizon): Buy FTNT 1–2 month put spread (5–10% OTM) to limit cost while capturing near-term downside from remediation uncertainty. Max loss = premium paid; target 2–4x return on premium if narrative widens.
• Directional long on winners (1–6 month horizon): Buy CRWD (or S) 3-month call spread (buy ATM, sell ~20% OTM) to play accelerated endpoint/XDR spend. Allocate 0.5–1% portfolio; expected asymmetric payoff if procurement rotations occur, capped cost limits downside.
• Contrarian recovery play (3–12 month horizon): If FTNT sells off >12% within two weeks, initiate a cheap long-term call spread (9–12 month, 5–15% OTM) sized 0.5–1% portfolio to capture rapid sentiment reversion given slow customer churn and sticky renewals. Reward profile: 3:1+ if breach impact remains contained.