Polls | Gaza | Fact Checker | Support Us
Sign In | Join Free |
UK FACT CHECK POLITICS
UK FACT CHECK POLITICS
 Voting intention Labour Lab 26% Reform Ref 21% Con Con 20% Green Grn 14% Lib Dem LD 10% Poll tracker

Menu

Topics
About
Get Involved
Follow Us

Account

Cyber attack alert: NHS says hackers can take control of networks

ukfactcheck.com 14 April 2026 at 12:43 View original article →

The original link is the material being checked. It may contain false or misleading claims — we link for transparency, not endorsement.

78/100
Verdict Mixed Mostly Verified

Most concrete, time-sensitive assertions in the article (existence of an NHS England National CSOC cyber alert CC-4766; Fortinet PSIRT advisory FG-IR-26-099 dated 4 April 2026; affected versions 7.4.5–7.4.6; unauthenticated improper access control leading to code/command execution; hotfix guidance; and CVSS 9.1) are supported by primary sources from NHS England and Fortinet.

✓ 5 checks out ✕ 0 disputed ? 9 unverified
☰ Full analysis The complete summary ⌄

Most concrete, time-sensitive assertions in the article (existence of an NHS England National CSOC cyber alert CC-4766; Fortinet PSIRT advisory FG-IR-26-099 dated 4 April 2026; affected versions 7.4.5–7.4.6; unauthenticated improper access control leading to code/command execution; hotfix guidance; and CVSS 9.1) are supported by primary sources from NHS England and Fortinet. Several supporting/context claims (CISA KEV listing with a specific add date and a federal remediation deadline; Shadowserver ‘~2,000 exposed’ count; and claims about a prior CVE being actively exploited) rely on secondary reporting and/or could not be validated from primary government catalogues within this research session due to access issues, so they are marked Unverified rather than False. The narrative framing is broadly consistent with available evidence, but some details appear embellished or internally inconsistent (e.g., watchTowr text as captured includes a contradictory clause about credentials).

What checked out (5)
  • NHS England (National CSOC) published cyber alert CC-4766 on 7 April 2026 warning of active exploitation of CVE-2026-35616 affecting Fortinet FortiClient EMS versions 7.4.5 and 7.4.6.
  • CVE-2026-35616 is described by both NHS England and Fortinet as an improper access control issue that may allow an unauthenticated attacker to execute unauthorised code/commands via crafted requests (i.e., unauthenticated remote code/command execution).
  • Fortinet PSIRT advisory FG-IR-26-099 exists, is dated 4 April 2026, and states Fortinet observed exploitation in the wild and urges installation of hotfixes for FortiClient EMS 7.4.5 and 7.4.6; FortiClient EMS 7.2 is not affected.
  • Fortinet’s advisory states the hotfix is sufficient as an interim measure and that an upcoming FortiClient EMS 7.4.7 will also include a fix.
  • Fortinet assigns CVSSv3 score 9.1 to CVE-2026-35616.
? Unverified claims 9 claims ⌄
  • NHS England’s alert CC-4766 was published specifically on a Tuesday (the date 7 April 2026 is Tuesday, but the weekday characterisation is not a claim made by the primary source and is treated here as unverified framing).
  • The article’s specific mechanism description that RCE occurs ‘through crafted API requests’ is directionally consistent with the advisory but the exact phrasing/attack surface details (API vs broader crafted requests) were not fully corroborated beyond general ‘crafted requests’ language.
  • CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities (KEV) catalogue on 6 April 2026 and set/ordered a federal remediation deadline of 9 April 2026 (could not validate directly from the CISA KEV catalogue during this session due to access error; only indirect corroboration from NHS England and other secondary sources).
  • Singapore’s Cyber Security Agency (CSA) issued an alert about CVE-2026-35616 (the alert exists and notes exploitation is ‘reportedly’ in the wild, but the article’s ‘other national cyber authorities’ breadth is not enumerated/verified here).
  • WatchTowr observed exploitation attempts against honeypots/sensors on 31 March 2026 (supported by watchTowr’s own post; treated as unverified externally because it is self-reported telemetry rather than independently confirmed in a primary public dataset).
  • Shadowserver tracks roughly 2,000 internet-accessible FortiClient EMS instances (supported by SecurityWeek reporting that references Shadowserver, but Shadowserver’s own primary dashboard/post was not retrieved in this session).
  • No breaches linked to CVE-2026-35616 have yet been publicly confirmed in the UK (absence-of-evidence claim; not practically confirmable exhaustively from public sources in a short verification window).
  • The earlier FortiClient EMS vulnerability CVE-2026-21643 was ‘under active exploitation’ weeks earlier (secondary reporting indicates exploitation claims exist, but vendor confirmation and definitive primary evidence are unclear and somewhat contested in reporting).
  • Commercial security firms (e.g., Tenable) rated CVE-2026-35616 at 9.8 (not corroborated from a primary Tenable page in this session; Fortinet’s own CVSS is 9.1).
⌕ Sources & how we checked Search journal, source grades, confidence ⌄
Confidence

Medium — Confidence is medium because the highest-priority technical claims are strongly supported by primary sources (NHS England CC-4766 and Fortinet FG-IR-26-099), but several notable supporting claims (CISA KEV add date/deadline; Shadowserver exposure numbers; Tenable’s alleged 9.8 rating; and ‘no UK breaches confirmed’) could not be fully validated from primary, up-to-date sources within this session, primarily due to inability to access the CISA KEV catalogue directly and lack of direct Shadowserver primary material.

Search journal

NHS England National CSOC alert CC-4766 FortiClient EMS CVE-2026-35616

Fortinet advisory FG-IR-26-099 CVE-2026-35616 FortiClient Endpoint Management Server 7.4.5 7.4.6 hotfix

CISA Known Exploited Vulnerabilities CVE-2026-35616 added 6 April 2026 remediation due 9 April 2026

WatchTowr exploitation attempts 31 March 2026 FortiClient EMS CVE-2026-35616 honeypots

Shadowserver 2000 internet-accessible FortiClient EMS instances 2,000 SecurityWeek Shadowserver FortiClient EMS

CVE-2026-21643 FortiClient EMS SQL injection actively exploited March 2026 Defused Shadowserver

Cyber Security Agency of Singapore alert AL-2026-031 CVE-2026-35616

≡ The article we checked Full text as retrieved ⌄
<p>NHS England has issued a high-severity cyber alert warning that a critical zero-day vulnerability in Fortinet&rsquo;s FortiClient Endpoint Management Server is being actively exploited and could allow attackers to take over vulnerable servers without logging in.</p> <p>In alert CC-4766, published on Tuesday, the NHS England National CSOC said CVE-2026-35616 affects FortiClient EMS versions 7.4.5 and 7.4.6 and allows remote code execution through crafted API requests. The agency said it was &ldquo;almost certain&rdquo; there would be further exploitation in the immediate future.</p> <p>The flaw is an access control failure in the platform&rsquo;s API, meaning an attacker needs no credentials and no user interaction to send malicious requests and run arbitrary code or commands with high privileges on the EMS server. It is being treated as a zero-day because exploitation was seen before a permanent fix was broadly available.</p> <p>Fortinet disclosed the issue in advisory FG-IR-26-099 on 4 April and said the vulnerability had been observed being exploited in the wild. The company released out-of-band hotfixes for EMS 7.4.5 and 7.4.6 and said customers should install them immediately, then move to version 7.4.7 once it is available. NHS England&rsquo;s alert repeats that advice. According to the NHS notice, FortiClient EMS 7.2.x is not affected.</p> <p>Fortinet has assigned the bug a severity score of 9.1 out of 10. Some commercial security firms, including Tenable, have rated it even higher at 9.8, reflecting the fact that the attack can be carried out remotely, without authentication and without any action from a user.</p> <p>The significance of the flaw lies in the role of FortiClient EMS itself. The software acts as a central management server for Fortinet&rsquo;s endpoint security tools, allowing administrators to deploy clients, push policies, manage certificates and control protections across large numbers of devices. Security analysts say a successful compromise of the EMS server could give intruders a route to disable defences, distribute malicious software or move further into a victim&rsquo;s network through a trusted administration channel.</p> <p>The US Cybersecurity and Infrastructure Security Agency added CVE-2026-35616 to its Known Exploited Vulnerabilities catalogue on 6 April and ordered federal agencies to remediate by 9 April. Inclusion on the KEV list is generally reserved for flaws for which there is evidence of real-world attacks. Singapore&rsquo;s Cyber Security Agency and other national cyber authorities have also issued alerts urging immediate hotfixing.</p> <p>Researchers say suspicious activity began before the public advisory was released. WatchTowr said it saw exploitation attempts against its honeypots on 31 March. Fortinet credited Simo Kohonen of Defused Cyber and researcher Nguyen Duc Anh with reporting the vulnerability after it had been observed in use. Shadowserver, cited by SecurityWeek, has said about 2,000 internet-accessible FortiClient EMS instances are visible online, suggesting a sizeable potential attack surface.</p> <p>No threat group has been publicly identified. However, security researchers say the bug is likely to be attractive to both ransomware operators and espionage actors because compromise of an EMS server can provide a path to multiple managed endpoints from a single system.</p> <p>The latest warning comes only weeks after another critical FortiClient EMS flaw, CVE-2026-21643, was found to be under active exploitation. That earlier vulnerability, a SQL injection issue, had already raised concerns about internet-exposed EMS deployments. The emergence of a second unauthenticated FortiClient EMS flaw in quick succession is likely to intensify scrutiny of the product&rsquo;s security and patching practices.</p> <p>For UK organisations, the NHS alert is likely to resonate beyond the health service. Fortinet products are widely used across public sector, government and critical infrastructure networks, and the incident is expected to sharpen attention on vendor risk, internet-exposed management systems and the speed at which organisations apply fixes for vulnerabilities known to be under active attack.</p> <p>No breaches linked to CVE-2026-35616 have yet been publicly confirmed in the UK. But with active exploitation already under way and public alerts now issued by Fortinet, CISA, NHS England and other cyber agencies, security teams are being urged to treat the flaw as an immediate incident-response priority rather than a routine software update.</p>

Share this fact check

← Check another article or image