Most concrete, time-sensitive assertions in the article (existence of an NHS England National CSOC cyber alert CC-4766; Fortinet PSIRT advisory FG-IR-26-099 dated 4 April 2026; affected versions 7.4.5–7.4.6; unauthenticated improper access control leading to code/command execution; hotfix guidance; and CVSS 9.1) are supported by primary sources from NHS England and Fortinet. Several supporting/context claims (CISA KEV listing with a specific add date and a federal remediation deadline; Shadowserver ‘~2,000 exposed’ count; and claims about a prior CVE being actively exploited) rely on secondary reporting and/or could not be validated from primary government catalogues within this research session due to access issues, so they are marked Unverified rather than False. The narrative framing is broadly consistent with available evidence, but some details appear embellished or internally inconsistent (e.g., watchTowr text as captured includes a contradictory clause about credentials).

What checked out (5)

• NHS England (National CSOC) published cyber alert CC-4766 on 7 April 2026 warning of active exploitation of CVE-2026-35616 affecting Fortinet FortiClient EMS versions 7.4.5 and 7.4.6.
• CVE-2026-35616 is described by both NHS England and Fortinet as an improper access control issue that may allow an unauthenticated attacker to execute unauthorised code/commands via crafted requests (i.e., unauthenticated remote code/command execution).
• Fortinet PSIRT advisory FG-IR-26-099 exists, is dated 4 April 2026, and states Fortinet observed exploitation in the wild and urges installation of hotfixes for FortiClient EMS 7.4.5 and 7.4.6; FortiClient EMS 7.2 is not affected.
• Fortinet’s advisory states the hotfix is sufficient as an interim measure and that an upcoming FortiClient EMS 7.4.7 will also include a fix.
• Fortinet assigns CVSSv3 score 9.1 to CVE-2026-35616.

• NHS England’s alert CC-4766 was published specifically on a Tuesday (the date 7 April 2026 is Tuesday, but the weekday characterisation is not a claim made by the primary source and is treated here as unverified framing).
• The article’s specific mechanism description that RCE occurs ‘through crafted API requests’ is directionally consistent with the advisory but the exact phrasing/attack surface details (API vs broader crafted requests) were not fully corroborated beyond general ‘crafted requests’ language.
• CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities (KEV) catalogue on 6 April 2026 and set/ordered a federal remediation deadline of 9 April 2026 (could not validate directly from the CISA KEV catalogue during this session due to access error; only indirect corroboration from NHS England and other secondary sources).
• Singapore’s Cyber Security Agency (CSA) issued an alert about CVE-2026-35616 (the alert exists and notes exploitation is ‘reportedly’ in the wild, but the article’s ‘other national cyber authorities’ breadth is not enumerated/verified here).
• WatchTowr observed exploitation attempts against honeypots/sensors on 31 March 2026 (supported by watchTowr’s own post; treated as unverified externally because it is self-reported telemetry rather than independently confirmed in a primary public dataset).
• Shadowserver tracks roughly 2,000 internet-accessible FortiClient EMS instances (supported by SecurityWeek reporting that references Shadowserver, but Shadowserver’s own primary dashboard/post was not retrieved in this session).
• No breaches linked to CVE-2026-35616 have yet been publicly confirmed in the UK (absence-of-evidence claim; not practically confirmable exhaustively from public sources in a short verification window).
• The earlier FortiClient EMS vulnerability CVE-2026-21643 was ‘under active exploitation’ weeks earlier (secondary reporting indicates exploitation claims exist, but vendor confirmation and definitive primary evidence are unclear and somewhat contested in reporting).
• Commercial security firms (e.g., Tenable) rated CVE-2026-35616 at 9.8 (not corroborated from a primary Tenable page in this session; Fortinet’s own CVSS is 9.1).

Confidence

Medium — Confidence is medium because the highest-priority technical claims are strongly supported by primary sources (NHS England CC-4766 and Fortinet FG-IR-26-099), but several notable supporting claims (CISA KEV add date/deadline; Shadowserver exposure numbers; Tenable’s alleged 9.8 rating; and ‘no UK breaches confirmed’) could not be fully validated from primary, up-to-date sources within this session, primarily due to inability to access the CISA KEV catalogue directly and lack of direct Shadowserver primary material.

Search journal

NHS England National CSOC alert CC-4766 FortiClient EMS CVE-2026-35616

• https://digital.nhs.uk/cyber-alerts/2026/cc-4766

Fortinet advisory FG-IR-26-099 CVE-2026-35616 FortiClient Endpoint Management Server 7.4.5 7.4.6 hotfix

• https://fortiguard.fortinet.com/psirt/FG-IR-26-099

CISA Known Exploited Vulnerabilities CVE-2026-35616 added 6 April 2026 remediation due 9 April 2026

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

WatchTowr exploitation attempts 31 March 2026 FortiClient EMS CVE-2026-35616 honeypots

• https://watchtowr.com/resources/fortinet-forticlient-ems-zero-day-cve-2026-35616-active-exploitation-underway/

Shadowserver 2000 internet-accessible FortiClient EMS instances 2,000 SecurityWeek Shadowserver FortiClient EMS

• https://www.securityweek.com/exploitation-of-critical-fortinet-forticlient-ems-flaw-begins/

CVE-2026-21643 FortiClient EMS SQL injection actively exploited March 2026 Defused Shadowserver

• https://www.helpnetsecurity.com/2026/03/30/forticlient-ems-cve-2026-21643-reported-exploitation/
• https://www.securityweek.com/exploitation-of-critical-fortinet-forticlient-ems-flaw-begins/

Cyber Security Agency of Singapore alert AL-2026-031 CVE-2026-35616

• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-031/