CISA added the flaw to KEV after Fortinet confirmed exploitation in the wild

Fortinet released an emergency patch over the weekend for a critical FortiClient Enterprise Management Server (EMS) bug believed to be under attack since at least March 31.…

source https://go.theregister.com/feed/www.theregister.com/2026/04/06/forticlient_ems_bug_exploited/