Attackers exploited this critical FortiClient EMS bug as a 0-day

Critical CVE-2026-35616 (CVSS 9.1) in FortiClient EMS is being exploited in the wild; Fortinet released emergency hotfixes for EMS 7.4.5 and 7.4.6. CISA added the vulnerability to its KEV catalog and set a Thursday deadline for federal agencies to patch. WatchTowr observed exploitation beginning March 31 and VulnCheck reports ~100 internet-exposed instances, with attacks shifting from targeted 'low and slow' to opportunistic mass exploitation. This raises near-term operational and reputational risk for Fortinet customers and could pressure Fortinet shares and security service demand until patches are widely applied.

Analysis

This incident is more a reputational and procurement shock than a pure product-technical story; expect the immediate P&L impact to come from emergency engineering, channel support credits and delayed renewals rather than from lost hardware shipments. Quantitatively, model a 150–300bp hit to gross margin in the next two quarters for the vendor(s) directly implicated as they absorb remediation costs and accelerate security reviews, and assume a 1–3% revenue elasticity from churn/contract delays in affected enterprise segments over 3–12 months.

Second-order winners are defenders of enterprise consolidation: large diversified networking/security vendors and MSSPs who can offer migration paths and low-friction endpoint replacements will see outsized commercial leverage. Allocate a 0.5–1.5% ARR uplift over 3–12 months to incumbents that already have field sales hooks into affected accounts (networking refresh + security bolt-on), and expect channel partners to temporarily favor single-vendor deals with clearer patch/SLAs.

Key catalysts and tail risks are timing and attribution: rapid, verifiable remediation and narrow breach impact will normalize flows within weeks; conversely, attribution to a state-backed actor or evidence of credential/data exfiltration would trigger federal procurement friction and customer migrations that play out over 12–36 months. Monitor patch adoption rates, large public breach disclosures, and any new federal procurement guidance as the three highest‑information catalysts that will determine whether this is a transient hit or a multi-quarter re‑rating event.

Key Decisions for Investors

• Initiate a tactical short on FTNT: enter a 2–4 week to 3-month position via either a 1:1 short equity or buy 3-month OTM puts (15–20% OTM). Position size: 1–2% net portfolio exposure. Risk/reward: target 15–30% downside if renewal pressure and margin hit materialize; cut losses on a 10% adverse move or earlier if vendor provides detailed remediation telemetry.
• Pair trade — short FTNT / long CSCO (equal-dollar) for 1–6 months: CSCO is the defensive rotation beneficiary with broader networking foothold and less single-product concentration. Expect asymmetric payoff if customers re-contract with larger vendors; stop both legs if macro sell-off exceeds 8% to avoid systemic risk.
• Construct a limited-risk bearish FTNT spread: buy 3-month puts and sell nearer-dated puts to finance premium (put debit spread). This lowers cost while capping downside; size 1–2% NAV and target 20–25% relative return if the issue drives measurable churn.
• Long CSCO, 6–12 month horizon: accumulate on 3–8% pullbacks or buy-term calls (9–12 month) sized 1–3% NAV. Rationale: steady cashflow, cross-sell runway into enterprises reassessing endpoint vendors; target 8–15% upside versus carry cost.